apache/pulsar · error · RuntimeException

Failed to encrypt payload

Error message

Failed to encrypt payload

What it means

RawBatchMessageContainerImpl.encrypt wraps a message-encryption failure: the MessageCrypto encrypt call threw (bad key, wrong max output size, or crypto provider error) while encrypting the compressed batch payload.

Source

Thrown at pulsar-broker/src/main/java/org/apache/pulsar/client/impl/RawBatchMessageContainerImpl.java:74

        this.compressor = new CompressionCodecNone();
    }

    private ByteBuf encrypt(ByteBuf compressedPayload) {
        if (msgCrypto == null) {
            return compressedPayload;
        }
        int maxSize = msgCrypto.getMaxOutputSize(compressedPayload.readableBytes());
        ByteBuf encryptedPayload = allocator.buffer(maxSize);
        ByteBuffer targetBuffer = encryptedPayload.nioBuffer(0, maxSize);

        try {
            msgCrypto.encrypt(encryptionKeys, cryptoKeyReader, () -> messageMetadata,
                    compressedPayload.nioBuffer(), targetBuffer);
        } catch (PulsarClientException e) {
            encryptedPayload.release();
            compressedPayload.release();
            discard(e);
            throw new RuntimeException("Failed to encrypt payload", e);
        }
        encryptedPayload.writerIndex(targetBuffer.remaining());
        compressedPayload.release();
        return encryptedPayload;
    }

    @Override
    public ProducerImpl.OpSendMsg createOpSendMsg() {
        throw new UnsupportedOperationException();
    }

    /**
     * Sets a CryptoKeyReader instance to encrypt batched messages during serialization, `toByteBuf()`.
     * @param cryptoKeyReader a CryptoKeyReader instance
     */
    public void setCryptoKeyReader(CryptoKeyReader cryptoKeyReader) {
        this.cryptoKeyReader = cryptoKeyReader;
    }

View on GitHub (pinned to 820761864e)

Solutions

1. Verify the encryption public key is valid and current
2. Ensure the allocated buffer size (getMaxOutputSize) is sufficient and the crypto provider is configured

When it happens

Trigger: Thrown at pulsar-broker/src/main/java/org/apache/pulsar/client/impl/RawBatchMessageContainerImpl.java:74 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/8d529c65bc379107. Report an issue: GitHub.