SonarSource/sonarqube · error · IllegalArgumentException

if keyStoreType is

Error message

if keyStoreType is 

What it means

IllegalStateException raised in OkHttpClientBuilder.getDefaultKeyManager when reconstructing the JVM default key manager (mirroring sun.security.ssl.SSLContextImpl#getDefaultKeyManager): the javax.net.ssl.keyStore system property is empty (no default keystore configured) while the code requires one to build the SSL socket factory, so the truncated 'if keyStoreType is ...' message signals an invalid/absent default keystore configuration.

Source

Thrown at sonar-ws/src/main/java/org/sonarqube/ws/client/OkHttpClientBuilder.java:319

      System.out.println(msg);
    }
  }

  /**
   * Inspired from sun.security.ssl.SSLContextImpl#getDefaultKeyManager()
   */
  private static synchronized KeyManager[] getDefaultKeyManager() throws KeyStoreException, NoSuchProviderException,
    IOException, CertificateException, NoSuchAlgorithmException, UnrecoverableKeyException {
    final String defaultKeyStore = System.getProperty("javax.net.ssl.keyStore", "");
    String defaultKeyStoreType = System.getProperty("javax.net.ssl.keyStoreType", KeyStore.getDefaultType());
    String defaultKeyStoreProvider = System.getProperty("javax.net.ssl.keyStoreProvider", "");

    logDebug("keyStore is : " + defaultKeyStore);
    logDebug("keyStore type is : " + defaultKeyStoreType);
    logDebug("keyStore provider is : " + defaultKeyStoreProvider);

    if (P11KEYSTORE.equals(defaultKeyStoreType) && !NONE.equals(defaultKeyStore)) {
      throw new IllegalArgumentException("if keyStoreType is " + P11KEYSTORE + ", then keyStore must be " + NONE);
    }

    KeyStore ks = null;
    String defaultKeyStorePassword = System.getProperty("javax.net.ssl.keyStorePassword", "");
    char[] passwd = defaultKeyStorePassword.isEmpty() ? null : defaultKeyStorePassword.toCharArray();

    // Try to initialize key store.
    if (!defaultKeyStoreType.isEmpty()) {
      logDebug("init keystore");
      if (defaultKeyStoreProvider.isEmpty()) {
        ks = KeyStore.getInstance(defaultKeyStoreType);
      } else {
        ks = KeyStore.getInstance(defaultKeyStoreType, defaultKeyStoreProvider);
      }
      if (!defaultKeyStore.isEmpty() && !NONE.equals(defaultKeyStore)) {
        try (FileInputStream fs = new FileInputStream(defaultKeyStore)) {
          ks.load(fs, passwd);
        }

View on GitHub (pinned to 184c821202)

Solutions

1. Set -Djavax.net.ssl.keyStore=NONE when using keyStoreType=PKCS11
2. Configure the PKCS11 token via a sunpkcs11 config file (security provider config)
3. Switch keyStoreType back to JKS/PKCS12 if you are actually using a file-based keystore

Example fix

// before
-Djavax.net.ssl.keyStoreType=PKCS11 -Djavax.net.ssl.keyStore=/etc/token/cert.pem
// after
-Djavax.net.ssl.keyStoreType=PKCS11 -Djavax.net.ssl.keyStore=NONE

if ("PKCS11".equalsIgnoreCase(System.getProperty("javax.net.ssl.keyStoreType", ""))
    && !"NONE".equals(System.getProperty("javax.net.ssl.keyStore"))) {
  throw new IllegalArgumentException("PKCS11 requires -Djavax.net.ssl.keyStore=NONE");
}

try {
  OkHttpClient client = new OkHttpClientBuilder().build();
} catch (IllegalArgumentException e) {
  if (e.getMessage().startsWith("if keyStoreType is PKCS11")) {
    System.setProperty("javax.net.ssl.keyStore", "NONE");
  }
}

When it happens

Trigger: Setting javax.net.ssl.keyStoreType to PKCS11 (SunPKCS11) while javax.net.ssl.keyStore is set to an actual file path rather than NONE, during getDefaultKeyManager invoked by systemDefaultSslSocketFactory.

Common situations: Misconfigured client-certificate setups with smartcards/HSMs where developers copy a file path from a JKS example into a PKCS11 configuration.

Related errors

• Failed to setup SSL context on ES client
• Failed to setup SSL context on ES client
• Unable to get default key manager
• Invalid certificate
• Error while loading PKCS8 private key, please check the form

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/120eb873ab30c4f4. Report an issue: GitHub.