NationalSecurityAgency/ghidra · critical · KeyStoreException

Failed to generate BSim server certificate

Error message

Failed to generate BSim server certificate

What it means

Thrown as a KeyStoreException wrapping NoSuchAlgorithmException or UnrecoverableEntryException during self-signed SSL certificate generation for the BSim server. The JCA/JCE could not find the requested key algorithm or recover a keystore entry needed to produce the public/private key pair files.

Source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/BSimControlLaunchable.java:588

				writer.println();
				String base64 = Base64.getEncoder().encodeToString(key.getEncoded());
				while (base64.length() != 0) {
					int endIndex = Math.min(44, base64.length());
					String line = base64.substring(0, endIndex);
					writer.println(line);
					base64 = base64.substring(endIndex);
				}
				writer.println("-----END PRIVATE KEY-----");
				writer.println();
			}

			passFile.setExecutable(false, false);		// Clear execute permission for everybody
			passFile.setReadable(false, false);			// Clear read permission for everybody
			passFile.setWritable(false, false);			// Clear write permission for everybody
			passFile.setReadable(true, true);			// Let owner read the file
		}
		catch (NoSuchAlgorithmException | UnrecoverableEntryException e) {
			throw new KeyStoreException("Failed to generate BSim server certificate", e);
		}
		finally {
			Arrays.fill(password, ' ');
			try {
				pp.destroy();
			}
			catch (DestroyFailedException e) {
				throw new AssertException(e); // unexpected for simple password clearing
			}
		}
	}

	/**
	 * Create a local connection to a postgres server. A full SSL connection is created using
	 * Ghidra's infrastructure.  If the initial connection fails because password authentication
	 * was requested, collect the administrative password from the user, and try the connection again
	 * @return the established connection object.  Respect any command-line "port= .." option.
	 * @throws SQLException if the db connection cannot be established

View on GitHub (pinned to d5f144c24d)

Solutions

1. Use a full JDK (not a stripped JRE) with standard crypto providers present.
2. Ensure required security providers are registered in java.security.
3. Upgrade to a supported Java version for the algorithm/key size requested.
4. Inspect the wrapped cause exception for the exact algorithm or entry name that failed.

// Probe the required crypto algorithm/provider availability before cert generation.
try {
    KeyPairGenerator.getInstance("RSA"); // or the algorithm the tool uses
} catch (NoSuchAlgorithmException e) {
    System.err.println("Required crypto algorithm unavailable in this JRE: " + e.getMessage());
    return;
}

try {
    launchable.generateCertificate(certFile, passFile);
} catch (KeyStoreException e) {
    Throwable cause = e.getCause();
    System.err.println("Certificate generation failed: " + cause);
    // cause is NoSuchAlgorithmException or UnrecoverableEntryException
    throw e;
}

When it happens

Trigger: The certificate generation code requests a key algorithm/size unavailable in the JRE, or a keystore entry cannot be recovered, raising one of the two caught exceptions which is then wrapped (line 588).

Common situations: Reduced/default JRE security policy, missing crypto providers (e.g. BouncyCastle not registered), outdated Java version, or restricted jurisdiction policy files blocking the key size.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Missing common name attribute
• Improperly formatted distinguished name
• File {} does not appear to be a certificate
• Path to certificate necessary to start server (--cert /path/
• Decompression limit exceeded: {}

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/3f3da24f0f8638a3. Report an issue: GitHub.