SonarSource/sonarqube · critical · IllegalStateException

"The property " + ENCRYPTION_SECRET_KEY_PATH + " does not li

Error message

"The property " + ENCRYPTION_SECRET_KEY_PATH + " does not link to a valid file: " + path

What it means

AesCipher.loadSecretFileFromFile throws this IllegalStateException when the configured path is set but the file at that path does not exist or is not a regular file (e.g. it is a directory). The exception names both the property (ENCRYPTION_SECRET_KEY_PATH, i.e. sonar.secretKeyPath) and the resolved path so the misconfiguration is easy to spot.

Source

Thrown at sonar-plugin-api-impl/src/main/java/org/sonar/api/config/internal/AesCipher.java:74

    if (StringUtils.isNotBlank(path)) {
      File file = new File(path);
      return file.exists() && file.isFile();
    }
    return false;
  }

  protected Key loadSecretFile() throws IOException {
    String path = getPathToSecretKey();
    return loadSecretFileFromFile(path);
  }

  Key loadSecretFileFromFile(@Nullable String path) throws IOException {
    if (StringUtils.isBlank(path)) {
      throw new IllegalStateException("Secret key not found. Please set the property " + ENCRYPTION_SECRET_KEY_PATH);
    }
    File file = new File(path);
    if (!file.exists() || !file.isFile()) {
      throw new IllegalStateException("The property " + ENCRYPTION_SECRET_KEY_PATH + " does not link to a valid file: " + path);
    }
    String s = FileUtils.readFileToString(file, UTF_8);
    if (StringUtils.isBlank(s)) {
      throw new IllegalStateException("No secret key in the file: " + path);
    }
    return new SecretKeySpec(Base64.decodeBase64(StringUtils.trim(s)), CRYPTO_KEY);
  }

  String generateRandomSecretKey() {
    try {
      KeyGenerator keyGen = KeyGenerator.getInstance(CRYPTO_KEY);
      keyGen.init(KEY_SIZE_IN_BITS, new SecureRandom());
      SecretKey secretKey = keyGen.generateKey();
      return Base64.encodeBase64String(secretKey.getEncoded());

    } catch (Exception e) {
      throw new IllegalStateException("Fail to generate secret key", e);
    }

View on GitHub (pinned to 184c821202)

Solutions

Check the path printed in the exception and create/copy the secret key file to that exact location.
Set sonar.secretKeyPath to an absolute path to avoid working-directory ambiguity.
Ensure the path is a regular file, not a directory, and that any symlink target exists.
In containers, mount the secret key file as a volume and confirm it exists inside the container.
Verify the SonarQube process user has read access to the file's directory and file.

Example fix

// before
sonar.secretKeyPath=./secret.key
// after
sonar.secretKeyPath=/opt/sonarqube/conf/secret.key

Defensive patterns

Strategy: validation

Validate before calling

File f = new File(secretKeyPath);
if (!f.isFile()) {
  throw new IllegalStateException("sonar.secretKeyPath must point to an existing regular file: " + secretKeyPath);
}

Try / catch

try {
  Key key = aesCipher.loadSecretFile();
} catch (IllegalStateException e) {
  LOG.error("Secret key file problem: " + e.getMessage());
}

Prevention

Use absolute paths in sonar.secretKeyPath
Verify the file exists and is a regular file after deployment (ls -l)
Mount secret files into containers explicitly and check them at startup
Ensure symlinks resolve and the service user can read the path

When it happens

Trigger: sonar.secretKeyPath points to a non-existent file, a directory, a symlink whose target was deleted, or a relative path that does not resolve relative to the SonarQube process working directory.

Common situations: Server migration where the secret key file was not copied; wrong absolute path or typo in sonar.properties; running SonarQube as a different user than expected with a different home directory; container images without the mounted secret file.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/e035d58ecd1d643c. Report an issue: GitHub.