What causes "Could not load KeyStore for type and provider" in apache/shenyu?

Fix the keyStoreType value to a standard type: JKS or PKCS12 (PKCS12 is the default since Java 9).

apache/shenyu · error · ShenyuException

Could not load KeyStore for type and provider

Error message

Could not load KeyStore for type and provider

What it means

HttpClientProperties loads a keystore from a configured path to set up mutual TLS for the HTTP client. After the KeyStore.getInstance(type, provider) call succeeds, a KeyStoreException or NoSuchProviderException means the JRE cannot supply a KeyStore implementation for the requested type/provider combination. The library wraps it in a ShenyuException so that the client bean creation fails fast instead of producing a half-configured SSL context.

Solutions

Fix the keyStoreType value to a standard type: JKS or PKCS12 (PKCS12 is the default since Java 9).
If keyStoreProvider is set, remove it or ensure the named provider is on the classpath and registered (Security.addProvider or java.security file).
Run a quick check: KeyStore.getInstance(type) in isolation to see which types your JVM supports.
If using a trimmed JRE, switch to a full JDK image or add the missing crypto module.

Example fix

// before
shenyu.httpclient.keyStoreType=PKS12
// after
shenyu.httpclient.keyStoreType=PKCS12

Defensive patterns

Strategy: validation

Validate before calling

String type = props.getKeyStoreType();
try {
    java.security.KeyStore.getInstance(type == null ? "PKCS12" : type);
} catch (Exception e) {
    throw new IllegalStateException("Unsupported keystore type: " + type, e);
}

Try / catch

try {
    // start client that uses the keystore
} catch (ShenyuException e) {
    if (e.getMessage().contains("KeyStore for type and provider")) {
        // fall back to default JVM keystore config or abort startup with clear message
    }
}

Prevention

Stick to standard keystore types JKS or PKCS12 unless a custom provider is genuinely required.
Only set keyStoreProvider when the provider jar is definitely on the classpath and registered.
Smoke-test TLS config in CI with the same JRE image used in production.
Avoid trimmed/jlink JRE images that omit keystore implementations.

When it happens

Trigger: Calling the keystore-building code in HttpClientProperties with keyStoreType set to a type the JVM has no provider for, or keyStoreProvider set to a provider class not present in the JDK/security providers list.

Common situations: Typo in the keystore type (e.g. 'PKS12' instead of 'PKCS12'); specifying a custom security provider that isn't registered via java.security or the provider jar missing from the classpath; running on a minimal JRE (jlink image) that excludes some keystore implementations.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of apache/shenyu@567142e072 (2026-09-12). Data as JSON: /api/errors/ac060f5ba7659072. Report an issue: GitHub.

Appendix: source

Thrown at shenyu-plugin/shenyu-plugin-httpclient/src/main/java/org/apache/shenyu/plugin/httpclient/config/HttpClientProperties.java:1156

            String provider = getKeyStoreProvider();
            String storeType = getKeyStoreType();
            String keyStorePath = getKeyStorePath();
            String keyStorePassword = getKeyStorePassword();
            try {
                KeyStore keyStore = StringUtils.isNotEmpty(provider)
                        ? KeyStore.getInstance(storeType, provider)
                        : KeyStore.getInstance(storeType);
                try {
                    char[] keyPassword = Optional.ofNullable(keyStorePassword)
                            .map(String::toCharArray).orElse(null);
                    URL url = ResourceUtils.getURL(keyStorePath);
                    keyStore.load(url.openStream(), keyPassword);
                } catch (Exception e) {
                    throw new ShenyuException("Could not load key store path ' " + keyStorePath + "'", e);
                }
                return keyStore;
            } catch (KeyStoreException | NoSuchProviderException e) {
                throw new ShenyuException("Could not load KeyStore for type and provider", e);
            }
        }
    }
}

View on GitHub (pinned to 567142e072)