SonarSource/sonarqube · error · IllegalStateException

Fail to generate secret key

Error message

Fail to generate secret key

What it means

AesCipher.generateRandomSecretKey builds an AES secret key via KeyGenerator and Base64-encodes it. Any failure while obtaining, initializing, or generating the key is wrapped in this IllegalStateException. The library throws it because a random secret key is fundamental to encrypted settings and should never silently fail.

Source

Thrown at sonar-plugin-api-impl/src/main/java/org/sonar/api/config/internal/AesCipher.java:91

    if (!file.exists() || !file.isFile()) {
      throw new IllegalStateException("The property " + ENCRYPTION_SECRET_KEY_PATH + " does not link to a valid file: " + path);
    }
    String s = FileUtils.readFileToString(file, UTF_8);
    if (StringUtils.isBlank(s)) {
      throw new IllegalStateException("No secret key in the file: " + path);
    }
    return new SecretKeySpec(Base64.decodeBase64(StringUtils.trim(s)), CRYPTO_KEY);
  }

  String generateRandomSecretKey() {
    try {
      KeyGenerator keyGen = KeyGenerator.getInstance(CRYPTO_KEY);
      keyGen.init(KEY_SIZE_IN_BITS, new SecureRandom());
      SecretKey secretKey = keyGen.generateKey();
      return Base64.encodeBase64String(secretKey.getEncoded());

    } catch (Exception e) {
      throw new IllegalStateException("Fail to generate secret key", e);
    }
  }

  String getPathToSecretKey() {
    if (StringUtils.isBlank(pathToSecretKey)) {
      pathToSecretKey = new File(FileUtils.getUserDirectoryPath(), ".sonar/sonar-secret.txt").getPath();
    }
    return pathToSecretKey;
  }

  public void setPathToSecretKey(@Nullable String pathToSecretKey) {
    this.pathToSecretKey = pathToSecretKey;
  }
}

View on GitHub (pinned to 184c821202)

Solutions

  1. Verify the JVM includes a standard JCE provider supporting AES with the requested key size (use a full JDK/JRE)
  2. Check that the configured key size (typically 128 bits) is allowed by local crypto policy (e.g. FIPS restrictions)
  3. Rule out entropy starvation on headless Linux by configuring -Djava.security.egd=file:/dev/urandom
  4. Upgrade the SonarQube plugin API / JRE to a supported combination

Example fix

// before
SecretKey key = AesCipher.generateRandomSecretKey();
// after
try {
  SecretKey key = AesCipher.generateRandomSecretKey();
} catch (IllegalStateException e) {
  // inspect e.getCause(): provider/key-size problem
}
Defensive patterns

Strategy: try-catch

Validate before calling

// check AES support before generating
try {
  javax.crypto.KeyGenerator.getInstance("AES");
} catch (java.security.NoSuchAlgorithmException e) {
  throw new RuntimeException("JVM lacks AES KeyGenerator provider", e);
}

Try / catch

try {
  SecretKey key = AesCipher.generateRandomSecretKey();
} catch (IllegalStateException e) {
  log.error("Key generation failed: {}", e.getCause());
  throw new ConfigurationException("Unable to generate encryption secret key", e);
}

Prevention

When it happens

Trigger: Calling generateRandomSecretKey() when the JVM's crypto provider cannot supply the 'AES' KeyGenerator, KEY_SIZE_IN_BITS is not supported by the installed JCE provider, or SecureRandom instantiation/entropy fails.

Common situations: Running on a restricted JVM or stripped-down JRE lacking the AES provider; FIPS-enabled environments rejecting the key size; low entropy on headless servers blocking SecureRandom; corrupted JCE policy files.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/3f8fb39bb225582d. Report an issue: GitHub.