@Rocky - how to suppress error: unable to find valid certification path to requested target on create storage volume

To suppress the "unable to find valid certification path to requested target" error during

CREATE STORAGE VOLUME

, you have two primary options: disabling the initial connectivity check (to allow the command to succeed) or fixing the underlying SSL verification issue. Option 1: Disable the Connectivity Check By default, StarRocks validates the storage accessibility during the

CREATE STORAGE VOLUME

command. If the remote endpoint uses a self-signed or untrusted certificate, the FE (Java) will throw a

PKIX path building failed

error. You can temporarily disable this check by setting the FE configuration:

sql
-- Run this on the FE (admin privilege required)
ADMIN SET FRONTEND CONFIG ("enable_storage_volume_access_check" = "false");

Note: This allows the volume to be created, but subsequent data operations (like loading or querying) may still fail if the FE or BE cannot verify the certificate. Option 2: Suppress SSL Verification in Properties If you are using an S3-compatible storage (like MinIO) with a self-signed certificate, you can attempt to disable SSL verification for that specific volume using the following property in the

PROPERTIES

clause:

sql
CREATE STORAGE VOLUME my_volume
TYPE = S3
LOCATIONS = ("<s3://bucket-name/>")
PROPERTIES (
    "aws.s3.endpoint" = "<https://your-endpoint>",
    "aws.s3.enable_ssl_verification" = "false",  -- Suppress SSL check
    "aws.s3.access_key" = "...",
    "aws.s3.secret_key" = "..."
);

Option 3: Import the Certificate (Recommended) Because the "unable to find valid certification path" error comes from the Java JVM, the most robust fix is to import the certificate of your storage service into the Java truststore on all FE nodes: 1. Download the certificate:

bash
    echo -n | openssl s_client -connect <ENDPOINT_HOST>:<PORT> | openssl x509 > storage.crt

2. Import to Java truststore:

bash
    keytool -import -alias storage_ca -file storage.crt -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit

3. Restart the FE. Option 4: Use HTTP If your environment allows it, changing the

aws.s3.endpoint

from

https://

to

http://

will bypass SSL verification entirely. References • sql-reference/sql-statements/cluster-management/storage_volume/CREATE_STORAGE_VOLUME.md

@Rocky Invalid properties aws.s3.enable_ssl_verification

The error

Invalid properties aws.s3.enable_ssl_verification

occurs because while StarRocks supports that property for features like External Tables and Load jobs, it is not a valid property for the

CREATE STORAGE VOLUME

statement in current versions. To suppress the certification path error and successfully create the storage volume, you should use one of the following methods: 1. Disable the Connectivity Check (Recommended Workaround) By default, the FE (Frontend) validates storage access during creation. If your storage uses a self-signed certificate that the FE's Java environment doesn't trust, the command fails. You can disable this check globally:

sql
-- Run this on the FE (requires ADMIN privilege)
ADMIN SET FRONTEND CONFIG ("enable_storage_volume_access_check" = "false");

After running this, your

CREATE STORAGE VOLUME

command will succeed even if the certificate is invalid. Note that data loading or queries might still require the certificate to be trusted by the FE/BE nodes later. 2. Use HTTP instead of HTTPS If your storage service (e.g., MinIO) supports it, the simplest way to bypass SSL issues is to use an

http

endpoint:

sql
CREATE STORAGE VOLUME my_s3_volume
TYPE = S3
LOCATIONS = ("<s3://bucket-name/>")
PROPERTIES (
    "aws.s3.endpoint" = "<http://your-minio-host:9000>", -- Use http
    "aws.s3.access_key" = "...",
    "aws.s3.secret_key" = "..."
);

3. Import the Certificate into the FE Java Truststore Since the FE is a Java process, the "unable to find valid certification path" error means the JVM does not trust the certificate. To fix this permanently for all

https

requests: 1. Extract the certificate from your storage endpoint:

bash
    openssl s_client -showcerts -connect <host>:<port> </dev/null | openssl x509 -outform PEM > storage.crt

2. Import the certificate into the Java truststore used by the StarRocks FE (usually located in

$JAVA_HOME/lib/security/cacerts

):

bash
    keytool -importcert -file storage.crt -keystore $JAVA_HOME/lib/security/cacerts -alias storage_ca -storepass changeit

3. Restart the FE. Summary of valid S3 Properties For

CREATE STORAGE VOLUME

, only a specific set of properties is allowed. These include: •

aws.s3.region

•

aws.s3.endpoint

•

aws.s3.access_key

•

aws.s3.secret_key

•

aws.s3.use_instance_profile

•

aws.s3.iam_role_arn

•

aws.s3.enable_path_style_access

Properties like

aws.s3.enable_ssl_verification

or

aws.s3.insecure

are not currently recognized in the

STORAGE VOLUME

syntax. References • integrations/authenticate_to_aws_resources.md • deployment/shared_data/s3.md • administration/user_privs/ssl_authentication.md