What causes "unsupported store type %q" in t8y2/dbx?

Set zookeepertruststoretype to one of: PEM, JKS, or PKCS12 (case-insensitive).

unsupported store type %q

Error message

unsupported store type %q

What it means

loadTrustStore ends in a default case returning "unsupported store type %q" when the resolved store type (after normalizedStoreType uppercases/trims zookeepertruststoretype and possibly infers from the extension) is not one of the handled formats (PEM/JKS/PKCS12). The library only knows how to parse those three truststore formats.

Source

Thrown at agents/drivers/argo-go/zookeeper_tls.go:115

				chain, getErr := store.GetPrivateKeyEntryCertificateChain(alias)
				if getErr != nil {
					return nil, getErr
				}
				for _, entry := range chain {
					certificate, parseErr := x509.ParseCertificate(entry.Content)
					if parseErr != nil {
						return nil, parseErr
					}
					certificates = append(certificates, certificate)
				}
			}
		}
		if len(certificates) == 0 {
			return nil, errors.New("JKS truststore contains no certificates")
		}
		return certificates, nil
	default:
		return nil, fmt.Errorf("unsupported store type %q", storeType)
	}
}

func loadClientKeyStore(path, password, storeType string) (tls.Certificate, error) {
	contents, err := os.ReadFile(path)
	if err != nil {
		return tls.Certificate{}, err
	}
	switch normalizedStoreType(storeType, path) {
	case "PEM":
		return tls.X509KeyPair(contents, contents)
	case "PKCS12":
		privateKey, certificate, chain, err := pkcs12.DecodeChain(contents, password)
		if err != nil {
			return tls.Certificate{}, err
		}
		result := tls.Certificate{PrivateKey: privateKey, Leaf: certificate}
		result.Certificate = append(result.Certificate, certificate.Raw)

View on GitHub (pinned to c0390bff16)

Solutions

Set zookeepertruststoretype to one of: PEM, JKS, or PKCS12 (case-insensitive).
Clear the parameter entirely to let normalizedStoreType infer the type from the file extension.
Convert BKS/other formats to PKCS12 (e.g. with keytool or openssl) and use the converted file.
Check the %q value in the message to see exactly what string was passed.

Example fix

// before
params.Set("zookeepertruststoretype", "BKS")
// after
params.Set("zookeepertruststoretype", "PKCS12") // or "PEM"/"JKS", or omit to infer from extension

Defensive patterns

Strategy: validation

Validate before calling

var supported = map[string]bool{"PEM": true, "JKS": true, "PKCS12": true}
st := strings.ToUpper(strings.TrimSpace(params.Get("zookeepertruststoretype")))
if st != "" && !supported[st] {
    return fmt.Errorf("zookeepertruststoretype %q not supported; use PEM, JKS, or PKCS12", st)
}

Try / catch

certs, err := loadTrustStore(loc, pw, st)
if err != nil {
    if strings.HasPrefix(err.Error(), "unsupported store type") {
        return fmt.Errorf("convert store to PEM/JKS/PKCS12 (got %s)", st)
    }
    return err
}

Prevention

Restrict store-type config values to an allowlist (PEM, JKS, PKCS12) at config load time.
Convert BKS/PKCS11 artifacts to PKCS12 before distributing them.
Prefer omitting the type parameter so it is inferred from the file extension.
Validate config schema in CI to catch typos before deployment.

When it happens

Trigger: parseConnectionConfig or buildTLSConfig passes a zookeepertruststoretype value like "JKS" misspelled as "jks-store", "BKS", "PKCS11", or any non-empty string that normalizedStoreType does not map to a supported branch.

Common situations: Copying JVM settings that use BKS (Android) or PKCS11 (HSM) stores; whitespace/casing mistakes combined with an unknown token; a docs example for a different driver; typos like "PEM" vs "P12" confusion.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/f031de4824f12c58. Report an issue: GitHub.