{"record":{"id":"0be1e0ab32c47aaa","repo":"stanfordnlp/CoreNLP","slug":"could-not-find-ssl-keystore-at-stanfordcorenlpse","errorCode":null,"errorMessage":"Could not find SSL keystore at ${StanfordCoreNLPServer.key}","messagePattern":"Could not find SSL keystore at (.+?)","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"src/edu/stanford/nlp/pipeline/StanfordCoreNLPServer.java","lineNumber":1660,"sourceCode":"  private static void sendAndGetResponse(HttpExchange httpExchange, byte[] response) throws IOException {\n    if (response.length > 0) {\n      httpExchange.getResponseHeaders().add(\"Content-type\", \"application/json\");\n      httpExchange.getResponseHeaders().add(\"Content-length\", Integer.toString(response.length));\n      httpExchange.sendResponseHeaders(HTTP_OK, response.length);\n      httpExchange.getResponseBody().write(response);\n      httpExchange.close();\n    }\n  }\n\n\n  private static HttpsServer addSSLContext(HttpsServer server) {\n    log(\"Adding SSL context to server; key=\" + StanfordCoreNLPServer.key);\n    try (InputStream is = IOUtils.getInputStreamFromURLOrClasspathOrFileSystem(key)) {\n      KeyStore ks = KeyStore.getInstance(\"JKS\");\n      if (StanfordCoreNLPServer.key != null && IOUtils.existsInClasspathOrFileSystem(StanfordCoreNLPServer.key)) {\n        ks.load(is, \"corenlp\".toCharArray());\n      } else {\n        throw new IllegalArgumentException(\"Could not find SSL keystore at \" + StanfordCoreNLPServer.key);\n      }\n      KeyManagerFactory kmf = KeyManagerFactory.getInstance(\"SunX509\");\n      kmf.init(ks, \"corenlp\".toCharArray());\n      SSLContext sslContext = SSLContext.getInstance(\"TLS\");\n      sslContext.init(kmf.getKeyManagers(), null, null);\n\n      // Add SSL support to the server\n      server.setHttpsConfigurator(new HttpsConfigurator(sslContext) {\n        @Override\n        public void configure(HttpsParameters params) {\n          SSLContext context = getSSLContext();\n          SSLEngine engine = context.createSSLEngine();\n          params.setNeedClientAuth(false);\n          params.setCipherSuites(engine.getEnabledCipherSuites());\n          params.setProtocols(engine.getEnabledProtocols());\n          params.setSSLParameters(context.getDefaultSSLParameters());\n        }\n      });","sourceCodeStart":1642,"sourceCodeEnd":1678,"githubUrl":"https://github.com/stanfordnlp/CoreNLP/blob/1b7edd19c4d0d7b1f13a2591425b9b60a0b1af7a/src/edu/stanford/nlp/pipeline/StanfordCoreNLPServer.java#L1642-L1678","documentation":"When SSL is enabled, the server loads a JKS keystore from the path given by the 'key' property/StanfordCoreNLPServer.key. If the keystore cannot be found via URL, classpath, or filesystem, an IllegalArgumentException naming the path is thrown before HTTPS can start.","triggerScenarios":"Starting the server with -key (or stanford.corenlp.server.key style config) pointing at a file that does not exist on disk, in the classpath, or at the given URL.","commonSituations":"Relative path resolved from a different working directory; keystore present in a Docker image layer not copied; typo in filename; forgetting the keystore file when redeploying; using the default key name without providing the file.","solutions":["Pass the correct absolute path via -key, e.g. -key /etc/corenlp/keystore.jks","Verify the file exists: ls at the path or IOUtils.existsInClasspathOrFileSystem equivalent","If packaged in a jar, confirm it is on the classpath and reference it by classpath-relative name","Create or copy a JKS keystore (password must be 'corenlp' for this server)"],"exampleFix":"// before\njava -cp corenlp.jar ... StanfordCoreNLPServer -ssl -key keystore.jks  // not in cwd\n// after\njava -cp corenlp.jar ... StanfordCoreNLPServer -ssl -key /etc/corenlp/keystore.jks","handlingStrategy":"validation","validationCode":"String key = serverKeyProp;\nif (sslEnabled) {\n  if (key == null || !new File(key).exists() && getClass().getResource(key) == null) {\n    throw new IllegalArgumentException(\"SSL keystore missing: \" + key);\n  }\n}","typeGuard":null,"tryCatchPattern":"try {\n  startServerSsl(keyPath);\n} catch (IllegalArgumentException e) {\n  if (e.getMessage().startsWith(\"Could not find SSL keystore\")) {\n    log.error(\"Keystore not found at \" + keyPath + \"; check path/classpath\");\n    throw e;\n  } else throw e;\n}","preventionTips":["Use absolute paths for -key so the working directory does not matter","Add keystore existence checks to deployment/startup scripts","Ship the keystore in the Docker image and verify with a smoke test","Remember the JKS password must be 'corenlp' for this server"],"tags":["ssl","keystore","file-not-found","https"],"backgroundTag":"file-not-found","analyzedSha":"1b7edd19c4d0d7b1f13a2591425b9b60a0b1af7a","analyzedAt":"2026-09-10T02:24:07.274Z","contentChangedAt":"2026-09-10T02:24:07.274Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}