alibaba/druid · error · IllegalArgumentException

Failed to get public key

Error message

Failed to get public key

What it means

ConfigTools.getPublicKeyByX509 reads an X.509 certificate file and extracts its public key. Any failure (file not found, IOException, CertificateException from CertificateFactory.getInstance("X.509") or generateCertificate, or the certificate carrying no key) is wrapped as IllegalArgumentException("Failed to get public key"). The FileInputStream is closed in finally.

Source

Thrown at core/src/main/java/com/alibaba/druid/filter/config/ConfigTools.java:90

        return decrypt(publicKey, cipherText);
    }

    public static PublicKey getPublicKeyByX509(String x509File) {
        if (x509File == null || x509File.length() == 0) {
            return ConfigTools.getPublicKey(null);
        }

        FileInputStream in = null;
        try {
            in = new FileInputStream(x509File);

            CertificateFactory factory = CertificateFactory
                    .getInstance("X.509");
            Certificate cer = factory.generateCertificate(in);
            return cer.getPublicKey();
        } catch (Exception e) {
            throw new IllegalArgumentException("Failed to get public key", e);
        } finally {
            JdbcUtils.close(in);
        }
    }

    public static PublicKey getPublicKey(String publicKeyText) {
        if (publicKeyText == null || publicKeyText.length() == 0) {
            publicKeyText = ConfigTools.DEFAULT_PUBLIC_KEY_STRING;
        }

        try {
            byte[] publicKeyBytes = Base64.base64ToByteArray(publicKeyText);
            X509EncodedKeySpec x509KeySpec = new X509EncodedKeySpec(
                    publicKeyBytes);

            KeyFactory keyFactory = KeyFactory.getInstance("RSA", "SunRsaSign");
            return keyFactory.generatePublic(x509KeySpec);
        } catch (Exception e) {

View on GitHub (pinned to fa8dc99126)

Solutions

1. Confirm the file is a valid X.509 certificate (openssl x509 -in file -noout -text succeeds).
2. Use getPublicKeyByPublicKeyFile or getPublicKey(String) instead if you have a raw Base64 RSA public key, not a certificate.
3. Check the path is absolute or resolvable from the JVM working directory and that the JVM can read it.

Example fix

// before
// ConfigTools.getPublicKeyByX509("/etc/app/server-pkcs8.der") // not a cert

// after
// ConfigTools.getPublicKeyByPublicKeyFile("/etc/app/pubkey.txt") // raw X509-encoded key

java.security.cert.Certificate c;
try (java.io.InputStream in = new java.io.FileInputStream(x509File)) {
    c = java.security.cert.CertificateFactory.getInstance("X.509").generateCertificate(in);
    c.getPublicKey(); // prove it parses before wiring
} catch (Exception e) { throw new IllegalArgumentException("bad cert file", e); }

try {
    PublicKey pk = ConfigTools.getPublicKeyByX509(x509File);
} catch (IllegalArgumentException e) {
    if (e.getMessage().equals("Failed to get public key")) {
        // verify file is a real X.509 cert: openssl x509 -in file -noout -text
    }
    throw e;
}

When it happens

Trigger: getPublicKeyByX509(x509File) is called with a path that does not exist, is unreadable, is not a valid DER/PEM X.509 certificate, or whose certificate factory cannot be instantiated.

Common situations: Pointing config key file at a non-certificate (e.g. a raw RSA key or a PKCS8 file) by mistake; wrong path; permission denied; a PEM file that is not a certificate block.

Related errors

• Cannot load remote config file from the [config.file={config
• Failed to decrypt.

AI-assisted analysis of alibaba/druid@fa8dc99126 (2026-08-14). Data as JSON: /api/errors/60cdcb0c12b41737. Report an issue: GitHub.