{"record":{"id":"325ecdc6a018a769","repo":"spring-projects/spring-boot","slug":"error-creating-keystore","errorCode":null,"errorMessage":"Error creating KeyStore: {}","messagePattern":"Error creating KeyStore: (.+?)","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"buildpack/spring-boot-buildpack-platform/src/main/java/org/springframework/boot/buildpack/platform/docker/ssl/KeyStoreFactory.java","lineNumber":68,"sourceCode":"\t * @param alias the alias to use for KeyStore entries\n\t * @return the {@code KeyStore}\n\t */\n\tstatic KeyStore create(Path certPath, @Nullable Path keyPath, String alias) {\n\t\ttry {\n\t\t\tKeyStore keyStore = getKeyStore();\n\t\t\tString certificateText = Files.readString(certPath);\n\t\t\tList<X509Certificate> certificates = PemCertificateParser.parse(certificateText);\n\t\t\tPrivateKey privateKey = getPrivateKey(keyPath);\n\t\t\ttry {\n\t\t\t\taddCertificates(keyStore, certificates.toArray(X509Certificate[]::new), privateKey, alias);\n\t\t\t}\n\t\t\tcatch (KeyStoreException ex) {\n\t\t\t\tthrow new IllegalStateException(\"Error adding certificates to KeyStore: \" + ex.getMessage(), ex);\n\t\t\t}\n\t\t\treturn keyStore;\n\t\t}\n\t\tcatch (GeneralSecurityException | IOException ex) {\n\t\t\tthrow new IllegalStateException(\"Error creating KeyStore: \" + ex.getMessage(), ex);\n\t\t}\n\t}\n\n\tprivate static KeyStore getKeyStore()\n\t\t\tthrows KeyStoreException, IOException, NoSuchAlgorithmException, CertificateException {\n\t\tKeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());\n\t\tkeyStore.load(null);\n\t\treturn keyStore;\n\t}\n\n\tprivate static @Nullable PrivateKey getPrivateKey(@Nullable Path path) throws IOException {\n\t\tif (path != null && Files.exists(path)) {\n\t\t\tString text = Files.readString(path);\n\t\t\treturn PemPrivateKeyParser.parse(text);\n\t\t}\n\t\treturn null;\n\t}\n","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/spring-projects/spring-boot/blob/270dfe353fb830fd69b823a8a859287ff103854b/buildpack/spring-boot-buildpack-platform/src/main/java/org/springframework/boot/buildpack/platform/docker/ssl/KeyStoreFactory.java#L50-L86","documentation":"The outer catch in KeyStoreFactory.create handles GeneralSecurityException | IOException from every setup-phase step: getKeyStore() (KeyStore.getInstance of the default type, load(null)), Files.readString(certPath), PemCertificateParser.parse(certificateText), and getPrivateKey(keyPath). It is the catch-all for any failure before addCertificates runs; the wrapped message is the underlying exception's getMessage().","triggerScenarios":"Any of: certPath missing or unreadable (IOException from Files.readString); KeyStore.getInstance(KeyStore.getDefaultType()) fails (no provider, stripped JRE); keyStore.load(null) fails; PemCertificateParser.parse throws IllegalStateException (propagates as cause since it is a RuntimeException, not caught by the GeneralSecurityException|IOException catch — it would escape this catch); getPrivateKey IO failure.","commonSituations":"certPath points to a non-existent or unreadable file; running on a custom jlink runtime whose default keystore type (PKCS12 on modern JDKs) is unavailable; PEM cert file is empty or corrupted.","solutions":["Confirm the cert file exists and is readable: `ls -l <certPath>` and `openssl x509 -in <certPath> -noout`.","On a custom JRE, ensure the default keystore type is available (do not exclude the PKCS12 provider).","Validate the PEM is a real certificate before invoking the build."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Pre-check the cert file before calling KeyStoreFactory\nif (!Files.exists(certPath) || !Files.isReadable(certPath)) {\n    throw new IllegalArgumentException(\"Certificate file missing or unreadable: \" + certPath);\n}\n// Validate it parses as X.509 PEM\ntry {\n    PemCertificateParser.parse(Files.readString(certPath));\n} catch (RuntimeException e) {\n    throw new IllegalArgumentException(\"Invalid certificate at \" + certPath + \": \" + e.getMessage(), e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    KeyStoreFactory.create(certPath, keyPath, alias);\n} catch (IllegalStateException ex) {\n    if (ex.getMessage().startsWith(\"Error creating KeyStore\")) {\n        Throwable c = ex.getCause();\n        // branch on IOException (file) vs GeneralSecurityException (crypto/JRE)\n    }\n    throw ex;\n}","preventionTips":["Pre-validate that cert files exist and are readable PEM.","On custom JREs, smoke-test KeyStore.getInstance(KeyStore.getDefaultType()).","Keep cert and key paths stable and well-tested in CI."],"tags":["docker","ssl","tls","keystore","io","buildpack"],"backgroundTag":null,"analyzedSha":"270dfe353fb830fd69b823a8a859287ff103854b","analyzedAt":"2026-08-11T19:42:06.541Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}