{"record":{"id":"120eb873ab30c4f4","repo":"SonarSource/sonarqube","slug":"if-keystoretype-is","errorCode":null,"errorMessage":"if keyStoreType is ","messagePattern":"if keyStoreType is ","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"sonar-ws/src/main/java/org/sonarqube/ws/client/OkHttpClientBuilder.java","lineNumber":319,"sourceCode":"      System.out.println(msg);\n    }\n  }\n\n  /**\n   * Inspired from sun.security.ssl.SSLContextImpl#getDefaultKeyManager()\n   */\n  private static synchronized KeyManager[] getDefaultKeyManager() throws KeyStoreException, NoSuchProviderException,\n    IOException, CertificateException, NoSuchAlgorithmException, UnrecoverableKeyException {\n    final String defaultKeyStore = System.getProperty(\"javax.net.ssl.keyStore\", \"\");\n    String defaultKeyStoreType = System.getProperty(\"javax.net.ssl.keyStoreType\", KeyStore.getDefaultType());\n    String defaultKeyStoreProvider = System.getProperty(\"javax.net.ssl.keyStoreProvider\", \"\");\n\n    logDebug(\"keyStore is : \" + defaultKeyStore);\n    logDebug(\"keyStore type is : \" + defaultKeyStoreType);\n    logDebug(\"keyStore provider is : \" + defaultKeyStoreProvider);\n\n    if (P11KEYSTORE.equals(defaultKeyStoreType) && !NONE.equals(defaultKeyStore)) {\n      throw new IllegalArgumentException(\"if keyStoreType is \" + P11KEYSTORE + \", then keyStore must be \" + NONE);\n    }\n\n    KeyStore ks = null;\n    String defaultKeyStorePassword = System.getProperty(\"javax.net.ssl.keyStorePassword\", \"\");\n    char[] passwd = defaultKeyStorePassword.isEmpty() ? null : defaultKeyStorePassword.toCharArray();\n\n    // Try to initialize key store.\n    if (!defaultKeyStoreType.isEmpty()) {\n      logDebug(\"init keystore\");\n      if (defaultKeyStoreProvider.isEmpty()) {\n        ks = KeyStore.getInstance(defaultKeyStoreType);\n      } else {\n        ks = KeyStore.getInstance(defaultKeyStoreType, defaultKeyStoreProvider);\n      }\n      if (!defaultKeyStore.isEmpty() && !NONE.equals(defaultKeyStore)) {\n        try (FileInputStream fs = new FileInputStream(defaultKeyStore)) {\n          ks.load(fs, passwd);\n        }","sourceCodeStart":301,"sourceCodeEnd":337,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/sonar-ws/src/main/java/org/sonarqube/ws/client/OkHttpClientBuilder.java#L301-L337","documentation":"IllegalStateException raised in OkHttpClientBuilder.getDefaultKeyManager when reconstructing the JVM default key manager (mirroring sun.security.ssl.SSLContextImpl#getDefaultKeyManager): the javax.net.ssl.keyStore system property is empty (no default keystore configured) while the code requires one to build the SSL socket factory, so the truncated 'if keyStoreType is ...' message signals an invalid/absent default keystore configuration.","triggerScenarios":"Setting javax.net.ssl.keyStoreType to PKCS11 (SunPKCS11) while javax.net.ssl.keyStore is set to an actual file path rather than NONE, during getDefaultKeyManager invoked by systemDefaultSslSocketFactory.","commonSituations":"Misconfigured client-certificate setups with smartcards/HSMs where developers copy a file path from a JKS example into a PKCS11 configuration.","solutions":["Set -Djavax.net.ssl.keyStore=NONE when using keyStoreType=PKCS11","Configure the PKCS11 token via a sunpkcs11 config file (security provider config)","Switch keyStoreType back to JKS/PKCS12 if you are actually using a file-based keystore"],"exampleFix":"// before\n-Djavax.net.ssl.keyStoreType=PKCS11 -Djavax.net.ssl.keyStore=/etc/token/cert.pem\n// after\n-Djavax.net.ssl.keyStoreType=PKCS11 -Djavax.net.ssl.keyStore=NONE","handlingStrategy":"validation","validationCode":"if (\"PKCS11\".equalsIgnoreCase(System.getProperty(\"javax.net.ssl.keyStoreType\", \"\"))\n    && !\"NONE\".equals(System.getProperty(\"javax.net.ssl.keyStore\"))) {\n  throw new IllegalArgumentException(\"PKCS11 requires -Djavax.net.ssl.keyStore=NONE\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  OkHttpClient client = new OkHttpClientBuilder().build();\n} catch (IllegalArgumentException e) {\n  if (e.getMessage().startsWith(\"if keyStoreType is PKCS11\")) {\n    System.setProperty(\"javax.net.ssl.keyStore\", \"NONE\");\n  }\n}","preventionTips":["Remember PKCS11 means a hardware token: keyStore must be NONE","Configure the token via a SunPKCS11 config file, not a file path","Use JKS/PKCS12 types for file-based keystores"],"tags":["ssl","pkcs11","keystore","config"],"backgroundTag":"conflicting-config-options","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}