{"record":{"id":"3f3da24f0f8638a3","repo":"NationalSecurityAgency/ghidra","slug":"failed-to-generate-bsim-server-certificate","errorCode":null,"errorMessage":"Failed to generate BSim server certificate","messagePattern":"Failed to generate BSim server certificate","errorType":"exception","errorClass":"KeyStoreException","httpStatus":null,"severity":"critical","filePath":"Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/BSimControlLaunchable.java","lineNumber":588,"sourceCode":"\t\t\t\twriter.println();\n\t\t\t\tString base64 = Base64.getEncoder().encodeToString(key.getEncoded());\n\t\t\t\twhile (base64.length() != 0) {\n\t\t\t\t\tint endIndex = Math.min(44, base64.length());\n\t\t\t\t\tString line = base64.substring(0, endIndex);\n\t\t\t\t\twriter.println(line);\n\t\t\t\t\tbase64 = base64.substring(endIndex);\n\t\t\t\t}\n\t\t\t\twriter.println(\"-----END PRIVATE KEY-----\");\n\t\t\t\twriter.println();\n\t\t\t}\n\n\t\t\tpassFile.setExecutable(false, false);\t\t// Clear execute permission for everybody\n\t\t\tpassFile.setReadable(false, false);\t\t\t// Clear read permission for everybody\n\t\t\tpassFile.setWritable(false, false);\t\t\t// Clear write permission for everybody\n\t\t\tpassFile.setReadable(true, true);\t\t\t// Let owner read the file\n\t\t}\n\t\tcatch (NoSuchAlgorithmException | UnrecoverableEntryException e) {\n\t\t\tthrow new KeyStoreException(\"Failed to generate BSim server certificate\", e);\n\t\t}\n\t\tfinally {\n\t\t\tArrays.fill(password, ' ');\n\t\t\ttry {\n\t\t\t\tpp.destroy();\n\t\t\t}\n\t\t\tcatch (DestroyFailedException e) {\n\t\t\t\tthrow new AssertException(e); // unexpected for simple password clearing\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Create a local connection to a postgres server. A full SSL connection is created using\n\t * Ghidra's infrastructure.  If the initial connection fails because password authentication\n\t * was requested, collect the administrative password from the user, and try the connection again\n\t * @return the established connection object.  Respect any command-line \"port= ..\" option.\n\t * @throws SQLException if the db connection cannot be established","sourceCodeStart":570,"sourceCodeEnd":606,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/BSimControlLaunchable.java#L570-L606","documentation":"Thrown as a KeyStoreException wrapping NoSuchAlgorithmException or UnrecoverableEntryException during self-signed SSL certificate generation for the BSim server. The JCA/JCE could not find the requested key algorithm or recover a keystore entry needed to produce the public/private key pair files.","triggerScenarios":"The certificate generation code requests a key algorithm/size unavailable in the JRE, or a keystore entry cannot be recovered, raising one of the two caught exceptions which is then wrapped (line 588).","commonSituations":"Reduced/default JRE security policy, missing crypto providers (e.g. BouncyCastle not registered), outdated Java version, or restricted jurisdiction policy files blocking the key size.","solutions":["Use a full JDK (not a stripped JRE) with standard crypto providers present.","Ensure required security providers are registered in java.security.","Upgrade to a supported Java version for the algorithm/key size requested.","Inspect the wrapped cause exception for the exact algorithm or entry name that failed."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Probe the required crypto algorithm/provider availability before cert generation.\ntry {\n    KeyPairGenerator.getInstance(\"RSA\"); // or the algorithm the tool uses\n} catch (NoSuchAlgorithmException e) {\n    System.err.println(\"Required crypto algorithm unavailable in this JRE: \" + e.getMessage());\n    return;\n}","typeGuard":null,"tryCatchPattern":"try {\n    launchable.generateCertificate(certFile, passFile);\n} catch (KeyStoreException e) {\n    Throwable cause = e.getCause();\n    System.err.println(\"Certificate generation failed: \" + cause);\n    // cause is NoSuchAlgorithmException or UnrecoverableEntryException\n    throw e;\n}","preventionTips":["Run on a full JDK with standard JCE providers present.","Register any extra security providers (e.g. BouncyCastle) in java.security if required.","Inspect the wrapped cause to identify the missing algorithm or entry."],"tags":["pki","certificate","security","jre","cryptography"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}