{"record":{"id":"42e144e51a041fbd","repo":"karatelabs/karate","slug":"failed-to-generate-self-signed-certificate-message","errorCode":null,"errorMessage":"failed to generate self-signed certificate: <message>","messagePattern":"failed to generate self-signed certificate: <message>","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"karate-core/src/main/java/io/karatelabs/core/SslUtils.java","lineNumber":85,"sourceCode":"            try (java.io.FileInputStream fis = new java.io.FileInputStream(ssc.certificate())) {\n                cert = cf.generateCertificate(fis);\n            }\n\n            // Load private key\n            java.security.PrivateKey privateKey = loadPrivateKeyFromFile(ssc.privateKey());\n\n            keyStore.setKeyEntry(\"server\", privateKey, new char[0], new Certificate[]{cert});\n\n            KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());\n            kmf.init(keyStore, new char[0]);\n\n            SSLContext ctx = SSLContext.getInstance(\"TLS\");\n            ctx.init(kmf.getKeyManagers(), null, new java.security.SecureRandom());\n\n            logger.info(\"generated self-signed certificate for localhost (valid {} days)\", VALIDITY_DAYS);\n            return ctx;\n        } catch (Exception e) {\n            throw new RuntimeException(\"failed to generate self-signed certificate: \" + e.getMessage(), e);\n        }\n    }\n\n    /**\n     * Generate a Netty SslContext for server use.\n     */\n    public static SslContext generateNettySslContext() {\n        try {\n            java.util.Date notBefore = new java.util.Date();\n            java.util.Date notAfter = new java.util.Date(notBefore.getTime() + (86400000L * VALIDITY_DAYS));\n\n            @SuppressWarnings(\"deprecation\")\n            SelfSignedCertificate ssc = new SelfSignedCertificate(\"localhost\", notBefore, notAfter);\n\n            return SslContextBuilder.forServer(ssc.certificate(), ssc.privateKey()).build();\n        } catch (Exception e) {\n            throw new RuntimeException(\"failed to generate Netty SSL context: \" + e.getMessage(), e);\n        }","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/karatelabs/karate/blob/a22eb90246d958d15a47bf436693d0121ad2812d/karate-core/src/main/java/io/karatelabs/core/SslUtils.java#L67-L103","documentation":"SslUtils.generateSelfSigned builds a key pair, self-signed X.509 certificate, and an SSLContext for localhost. Any exception in that pipeline (keygen, signing, context init) is wrapped as \"failed to generate self-signed certificate: <message>\".","triggerScenarios":"Starting an HTTPS Karate server without certPath, triggering self-signed generation; failure due to missing crypto providers, invalid default algorithm in the JVM, or internal key manager errors.","commonSituations":"Restricted/fips-only JVMs lacking needed algorithms; exotic JDK distributions without default X.509 facilities; security provider misconfiguration via java.security file.","solutions":["Inspect the chained cause; confirm the JVM supports key generation and 'TLS' SSLContext (run a minimal SSLContext.getInstance(\"TLS\") smoke test)","Check java.security providers config; ensure standard providers (SUN, SunJSSE) are enabled","Provide your own cert/key via the SSL config certPath/keyPath to bypass self-signed generation"],"exampleFix":"// before: relies on self-signed generation in a restricted JVM\n* configure ssl = { port: 8443 }\n// after: supply your own material\n* configure ssl = { port: 8443, certPath: 'certs/server.crt', keyPath: 'certs/server.key' }","handlingStrategy":"try-catch","validationCode":"// smoke-test JVM crypto before enabling self-signed HTTPS\nSSLContext.getInstance(\"TLS\").init(null, null, new SecureRandom());","typeGuard":null,"tryCatchPattern":"try { ctx = SslUtils.generateSelfSigned(); } catch (RuntimeException e) { throw new IllegalStateException(\"self-signed generation failed, check JVM security providers: \" + e.getCause(), e); }","preventionTips":["Use a mainstream JDK; avoid FIPS-only configurations unless configured for them","Check java.security provider list includes SUN and SunJSSE","Fallback: supply your own certPath/keyPath instead of self-signed generation"],"tags":["ssl","tls","self-signed","server"],"backgroundTag":"module-init-failed","analyzedSha":"a22eb90246d958d15a47bf436693d0121ad2812d","analyzedAt":"2026-09-12T09:01:00.220Z","contentChangedAt":"2026-09-12T09:01:00.220Z","schemaVersion":2},"datasetVersion":"2026-09-16T19:17:19.609Z"}