t8y2/dbx · error

unsupported store type %q

Error message

unsupported store type %q

What it means

loadTrustStore only recognizes the store types supported by normalizedStoreType; any other 'zookeepertruststoretype' value hits the default branch and produces 'unsupported store type %q'. This guards against silently parsing a truststore with the wrong decoder.

Source

Thrown at agents/drivers/hive-go/zookeeper_tls.go:115

				chain, getErr := store.GetPrivateKeyEntryCertificateChain(alias)
				if getErr != nil {
					return nil, getErr
				}
				for _, entry := range chain {
					certificate, parseErr := x509.ParseCertificate(entry.Content)
					if parseErr != nil {
						return nil, parseErr
					}
					certificates = append(certificates, certificate)
				}
			}
		}
		if len(certificates) == 0 {
			return nil, errors.New("JKS truststore contains no certificates")
		}
		return certificates, nil
	default:
		return nil, fmt.Errorf("unsupported store type %q", storeType)
	}
}

func loadClientKeyStore(path, password, storeType string) (tls.Certificate, error) {
	contents, err := os.ReadFile(path)
	if err != nil {
		return tls.Certificate{}, err
	}
	switch normalizedStoreType(storeType, path) {
	case "PEM":
		return tls.X509KeyPair(contents, contents)
	case "PKCS12":
		privateKey, certificate, chain, err := pkcs12.DecodeChain(contents, password)
		if err != nil {
			return tls.Certificate{}, err
		}
		result := tls.Certificate{PrivateKey: privateKey, Leaf: certificate}
		result.Certificate = append(result.Certificate, certificate.Raw)

View on GitHub (pinned to c0390bff16)

Solutions

1. Set zookeepertruststoretype to a supported value: JKS, PKCS12, or PEM
2. Verify the type matches the actual file contents (PKCS12 files often carry a .p12/.pfx extension)
3. Check normalizedStoreType in zookeeper_tls.go for the exact accepted values and normalization rules
4. If the file is a plain PEM bundle, either set type=PEM or omit the type if the default resolves it

Example fix

// before
params: zookeepertruststorelocation=trust.jks, zookeepertruststoretype=PFX
// after
params: zookeepertruststorelocation=trust.jks, zookeepertruststoretype=JKS

func validateTrustStoreType(storeType string) error {
  switch strings.ToUpper(strings.TrimSpace(storeType)) {
  case "", "JKS", "PKCS12", "PEM":
    return nil
  default:
    return fmt.Errorf("unsupported truststore type %q (use JKS, PKCS12 or PEM)", storeType)
  }
}

When it happens

Trigger: buildTLSConfig or buildZooKeeperTLSConfig calls loadTrustStore with a storeType that normalizedStoreType cannot resolve to a known format (e.g. 'PFX-BUNDLE', empty type with a path that doesn't imply a known extension, or a typo like 'JKSX').

Common situations: Setting zookeepertruststoretype=JKS on a PKCS12 file or vice versa; using a casing/spacing variant outside the normalized set; forgetting to set the type for a PEM truststore.

Related errors

• load ZooKeeper keystore: %w
• Hive storePasswordPath uses the Java Hadoop credential-provi
• Hive storePasswordPath uses the Java Hadoop credential-provi
• JKS private key entry has no certificate chain
• JKS keystore contains no private key entry

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/9385d71218aa46de. Report an issue: GitHub.