Ranger KMS HSM configuration

Dalier — Thu, 16 Oct 2025 20:00:18 GMT

Hi!

I am getting the following error while restarting the Ranger KMS service after configuring the HSM.

Please advise.

Dalier.

Thu Oct 16 15:36:41 EDT 2025
JAVA_HOME=/usr/lib/jvm/java-openjdk
Using -XX:OnOutOfMemoryError=/opt/cloudera/cm-agent/service/common/killparent.sh as CSD_JAVA_OPTS
Using /var/run/cloudera-scm-agent/process/1546345804-ranger_kms-RANGER_KMS_SERVER as conf dir
Using scripts/control.sh as process script
CONF_DIR=/var/run/cloudera-scm-agent/process/1546345804-ranger_kms-RANGER_KMS_SERVER
CMF_CONF_DIR=
Thu Oct 16 15:36:42 EDT 2025: [I] Using : /opt/cloudera/cm/lib/postgresql-42.5.1.jar and org.postgresql.Driver for postgresql database type

ERROR: Hadoop KMS could not be started

REASON: java.lang.NullPointerException: Cannot invoke "org.apache.hadoop.crypto.key.kms.server.KeyAuthorizationKeyProvider$KeyACLs.startReloader()" because "this.implKeyACLs" is null

Stacktrace:
---------------------------------------------------
java.lang.NullPointerException: Cannot invoke "org.apache.hadoop.crypto.key.kms.server.KeyAuthorizationKeyProvider$KeyACLs.startReloader()" because "this.implKeyACLs" is null
at org.apache.ranger.authorization.kms.authorizer.RangerKmsAuthorizer.startReloader(RangerKmsAuthorizer.java:184)
at org.apache.hadoop.crypto.key.kms.server.KMSWebApp.contextInitialized(KMSWebApp.java:137)
at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4441)
at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:4899)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:171)
at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1364)
at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1354)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
at java.base/java.lang.Thread.run(Thread.java:840)
---------------------------------------------------

Re: Ranger KMS HSM configuration

upadhyayk04 — Fri, 17 Oct 2025 02:11:24 GMT

Hello @Dalier

Thank you for reaching out to the Cloudera community

Could you please confirm if this is a fresh installation?

Also, what is the CDP CM and Java version used?

Which HSM are you using?

Have you followed the steps mentioned below

https://docs.cloudera.com/cdp-private-cloud-base/7.1.8/security-encrypting-data-at-rest/topics/security-ranger-kms-integrating-components-for-EDAR.html

question Re: Ranger KMS HSM configuration in Support Questions

Ranger KMS HSM configuration

Re: Ranger KMS HSM configuration