{"record":{"id":"39d06bb548413b76","repo":"SonarSource/sonarqube","slug":"secret-key-not-found-please-set-the-property","errorCode":null,"errorMessage":"\"Secret key not found. Please set the property \" + ENCRYPTION_SECRET_KEY_PATH","messagePattern":"\"Secret key not found\\. Please set the property \" \\+ ENCRYPTION_SECRET_KEY_PATH","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"critical","filePath":"sonar-plugin-api-impl/src/main/java/org/sonar/api/config/internal/AesCipher.java","lineNumber":70,"sourceCode":"   * This method checks the existence of the file, but not the validity of the contained key.\n   */\n  boolean hasSecretKey() {\n    String path = getPathToSecretKey();\n    if (StringUtils.isNotBlank(path)) {\n      File file = new File(path);\n      return file.exists() && file.isFile();\n    }\n    return false;\n  }\n\n  protected Key loadSecretFile() throws IOException {\n    String path = getPathToSecretKey();\n    return loadSecretFileFromFile(path);\n  }\n\n  Key loadSecretFileFromFile(@Nullable String path) throws IOException {\n    if (StringUtils.isBlank(path)) {\n      throw new IllegalStateException(\"Secret key not found. Please set the property \" + ENCRYPTION_SECRET_KEY_PATH);\n    }\n    File file = new File(path);\n    if (!file.exists() || !file.isFile()) {\n      throw new IllegalStateException(\"The property \" + ENCRYPTION_SECRET_KEY_PATH + \" does not link to a valid file: \" + path);\n    }\n    String s = FileUtils.readFileToString(file, UTF_8);\n    if (StringUtils.isBlank(s)) {\n      throw new IllegalStateException(\"No secret key in the file: \" + path);\n    }\n    return new SecretKeySpec(Base64.decodeBase64(StringUtils.trim(s)), CRYPTO_KEY);\n  }\n\n  String generateRandomSecretKey() {\n    try {\n      KeyGenerator keyGen = KeyGenerator.getInstance(CRYPTO_KEY);\n      keyGen.init(KEY_SIZE_IN_BITS, new SecureRandom());\n      SecretKey secretKey = keyGen.generateKey();\n      return Base64.encodeBase64String(secretKey.getEncoded());","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/sonar-plugin-api-impl/src/main/java/org/sonar/api/config/internal/AesCipher.java#L52-L88","documentation":"AesCipher.loadSecretFileFromFile throws this IllegalStateException when the configured path to the AES secret key is null, empty or blank. SonarQube uses this secret key file to encrypt/decrypt secure settings, so without it secure configuration cannot be processed. The message points the user to the ENCRYPTION_SECRET_KEY_PATH property (sonar.secretKeyPath).","triggerScenarios":"Calling loadSecretFile() (or loadSecretFileFromFile with a blank path) while the sonar.secretKeyPath property is not set and no default location (~/.sonar/secret.key) contains a key.","commonSituations":"Fresh SonarQube installation where encryption was never initialized; trying to read encrypted settings (sonar.token, JDBC password) without running the secret key generation; migrating a server without copying the secret key file; property typo so the path resolves to blank.","solutions":["Generate and place a secret key file (e.g. run the SonarQube encryption/secret-key generation) at the location expected by sonar.secretKeyPath.","Set sonar.secretKeyPath in sonar.properties to point at the existing Base64 secret key file.","If migrating, copy the original secret.key file from the old installation to the new server's configured path.","Verify the property name and value are correct (no blank/whitespace value)."],"exampleFix":"// sonar.properties\n// before: property missing -> IllegalStateException\n// after:\nsonar.secretKeyPath=/opt/sonarqube/conf/secret.key","handlingStrategy":"validation","validationCode":"String path = settings.get(\"sonar.secretKeyPath\");\nif (path == null || path.isBlank()) {\n  throw new IllegalStateException(\"sonar.secretKeyPath must be set to use encrypted settings\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  Key key = aesCipher.loadSecretFile();\n} catch (IllegalStateException e) {\n  LOG.error(\"Configure sonar.secretKeyPath: \" + e.getMessage());\n}","preventionTips":["Initialize encryption and generate the secret key during installation","Keep sonar.secretKeyPath set in sonar.properties on every environment","Include the secret key file in migration/runbook checklists","Validate configuration at startup before touching encrypted settings"],"tags":["encryption","configuration","secret-key","sonarqube"],"backgroundTag":"missing-required-config-field","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}