{"record":{"id":"27698bea0e80e105","repo":"apache/shenyu","slug":"could-not-load-certificate-trustedcert","errorCode":null,"errorMessage":"Could not load certificate '${trustedCert}'","messagePattern":"Could not load certificate '(.+?)'","errorType":"exception","errorClass":"ShenyuException","httpStatus":null,"severity":"error","filePath":"shenyu-plugin/shenyu-plugin-httpclient/src/main/java/org/apache/shenyu/plugin/httpclient/config/HttpClientProperties.java","lineNumber":1101,"sourceCode":"        /**\n         * Get trusted x 509 certificates for trust manager x 509 certificate [].\n         *\n         * @return the x 509 certificate []\n         */\n        @SuppressWarnings(\"all\")\n        public X509Certificate[] getTrustedX509CertificatesForTrustManager() {\n            try {\n                CertificateFactory certificateFactory = CertificateFactory\n                        .getInstance(\"X.509\");\n                List<Certificate> allCerts = new ArrayList<>();\n                for (String trustedCert : ssl.getTrustedX509Certificates()) {\n                    try {\n                        URL url = ResourceUtils.getURL(trustedCert);\n                        Collection<? extends Certificate> certs = certificateFactory\n                                .generateCertificates(url.openStream());\n                        allCerts.addAll(certs);\n                    } catch (IOException e) {\n                        throw new ShenyuException(\n                                \"Could not load certificate '\" + trustedCert + \"'\", e);\n                    }\n                }\n                return allCerts.toArray(new X509Certificate[allCerts.size()]);\n            } catch (CertificateException e) {\n                throw new ShenyuException(\"Could not load CertificateFactory X.509\", e);\n            }\n        }\n    \n        /**\n         * Gets key manager factory.\n         *\n         * @return the key manager factory\n         */\n        public KeyManagerFactory getKeyManagerFactory() {\n            try {\n                if (StringUtils.isNotEmpty(getKeyStorePath())) {\n                    KeyManagerFactory keyManagerFactory = KeyManagerFactory","sourceCodeStart":1083,"sourceCodeEnd":1119,"githubUrl":"https://github.com/apache/shenyu/blob/567142e07261b3e615ae8850b30f4421f455cc5d/shenyu-plugin/shenyu-plugin-httpclient/src/main/java/org/apache/shenyu/plugin/httpclient/config/HttpClientProperties.java#L1083-L1119","documentation":"HttpClientProperties builds a TrustManager from the configured trusted certificates. For each trustedCert path it resolves a resource URL and parses certificates with an X.509 CertificateFactory; if reading the resource throws IOException, a ShenyuException naming the cert path is thrown during HTTP client initialization.","triggerScenarios":"shenyu.httpclient.ssl.trustedCert (or equivalent config) points to a file that cannot be opened: wrong path, not on the classpath/filesystem, unreadable permissions, or container image missing the cert file — url.openStream() raises IOException.","commonSituations":"Mounting certs at a different path in Docker than configured, typo in the cert path property, relative path resolved against the wrong working directory, Kubernetes secret not mounted, cert file renamed after a rotation.","solutions":["Verify the trustedCert path exists and is readable from the gateway process (use an absolute path or classpath: prefix as appropriate).","Mount/ship the certificate file into the container/pod at the configured path.","Fix file permissions so the gateway user can read the cert.","Check the wrapped IOException cause for the precise reason (ENOENT vs permission vs connection for remote URLs)."],"exampleFix":"// before (application.yml)\nshenyu.httpclient.ssl.trusted-cert: /etc/ssl/old/ca.pem\n// after\nshenyu.httpclient.ssl.trusted-cert: /etc/ssl/certs/ca-current.pem","handlingStrategy":"validation","validationCode":"File cert = new File(trustedCertPath);\nif (!cert.isFile() || !cert.canRead()) {\n  throw new IllegalStateException(\"trustedCert not readable: \" + cert.getAbsolutePath());\n}","typeGuard":"function isReadableFile(p) {\n  try { return require('fs').accessSync(p, require('fs').constants.R_OK) === undefined; }\n  catch { return false; }\n}","tryCatchPattern":"try {\n  trustManager = buildTrustManager(trustedCertPaths);\n} catch (ShenyuException e) {\n  log.error(\"TLS trust material missing: {}\", e.getMessage(), e);\n  throw new IllegalStateException(\"Fix trustedCert path before starting gateway\", e);\n}","preventionTips":["Use absolute paths (or explicit classpath: prefixes) for cert configuration.","Verify cert files exist in the container image / mounted volumes at startup.","Fail fast with a preflight check on boot instead of at first TLS use."],"tags":["tls","configuration","file-not-found"],"backgroundTag":"file-not-found","analyzedSha":"567142e07261b3e615ae8850b30f4421f455cc5d","analyzedAt":"2026-09-12T10:08:21.293Z","contentChangedAt":"2026-09-12T10:08:21.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}