apache/pulsar · error · IllegalArgumentException

Failed to set encryption keys

Error message

Failed to set encryption keys

What it means

RawBatchMessageContainerImpl.toByteBuf: while preparing an encrypted batch, setting the encryption keys from the message's encryption context failed — typically because the crypto key reader or encryption context is missing/invalid, and the batch is discarded.

Source

Thrown at pulsar-broker/src/main/java/org/apache/pulsar/client/impl/RawBatchMessageContainerImpl.java:165

            EncryptionContext encryptionContext = (EncryptionContext) lastMessage.getEncryptionCtx().get();

            if (cryptoKeyReader == null) {
                IllegalStateException ex =
                        new IllegalStateException("Messages are encrypted but no cryptoKeyReader is provided.");
                discard(ex);
                throw ex;
            }

            encryptionKeys = encryptionContext.getKeys().keySet();
            if (msgCrypto == null) {
                msgCrypto =
                        new MessageCryptoBc(String.format(
                                "[%s] [%s]", topicName, "RawBatchMessageContainer"), true);
                try {
                    msgCrypto.addPublicKeyCipher(encryptionKeys, cryptoKeyReader);
                } catch (PulsarClientException.CryptoException e) {
                    discard(e);
                    throw new IllegalArgumentException("Failed to set encryption keys", e);
                }
            }
        }

        ByteBuf encryptedPayload = encrypt(getCompressedBatchMetadataAndPayload(false));
        updateAndReserveBatchAllocatedSize(encryptedPayload.capacity());
        ByteBuf metadataAndPayload = Commands.serializeMetadataAndPayload(Commands.ChecksumType.Crc32c,
                messageMetadata, encryptedPayload);

        MessageIdData idData = new MessageIdData();
        idData.setLedgerId(lastMessageId.getLedgerId());
        idData.setEntryId(lastMessageId.getEntryId());
        idData.setPartition(lastMessageId.getPartitionIndex());

        // Format: [IdSize][Id][metadataAndPayloadSize][metadataAndPayload]
        // Following RawMessage.serialize() format as the compacted messages will be parsed as RawMessage in broker
        int idSize = idData.getSerializedSize();
        int headerSize = 4 /* IdSize */ + idSize + 4 /* metadataAndPayloadSize */;

View on GitHub (pinned to 820761864e)

Solutions

1. Provide a valid cryptoKeyReader for encrypted messages
2. Check that the EncryptionContext keys are accessible and non-empty

When it happens

Trigger: Thrown at pulsar-broker/src/main/java/org/apache/pulsar/client/impl/RawBatchMessageContainerImpl.java:165 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/8fa8710cbb186698. Report an issue: GitHub.