{"record":{"id":"490a09c6720c8c0f","repo":"apache/shenyu","slug":"could-not-load-key-store-path-keystorepath","errorCode":null,"errorMessage":"Could not load key store path ' ${keyStorePath}'","messagePattern":"Could not load key store path ' (.+?)'","errorType":"exception","errorClass":"ShenyuException","httpStatus":null,"severity":"error","filePath":"shenyu-plugin/shenyu-plugin-httpclient/src/main/java/org/apache/shenyu/plugin/httpclient/config/HttpClientProperties.java","lineNumber":1152,"sourceCode":"         *\n         * @return the key store\n         */\n        public KeyStore createKeyStore() {\n            String provider = getKeyStoreProvider();\n            String storeType = getKeyStoreType();\n            String keyStorePath = getKeyStorePath();\n            String keyStorePassword = getKeyStorePassword();\n            try {\n                KeyStore keyStore = StringUtils.isNotEmpty(provider)\n                        ? KeyStore.getInstance(storeType, provider)\n                        : KeyStore.getInstance(storeType);\n                try {\n                    char[] keyPassword = Optional.ofNullable(keyStorePassword)\n                            .map(String::toCharArray).orElse(null);\n                    URL url = ResourceUtils.getURL(keyStorePath);\n                    keyStore.load(url.openStream(), keyPassword);\n                } catch (Exception e) {\n                    throw new ShenyuException(\"Could not load key store path ' \" + keyStorePath + \"'\", e);\n                }\n                return keyStore;\n            } catch (KeyStoreException | NoSuchProviderException e) {\n                throw new ShenyuException(\"Could not load KeyStore for type and provider\", e);\n            }\n        }\n    }\n}\n","sourceCodeStart":1134,"sourceCodeEnd":1161,"githubUrl":"https://github.com/apache/shenyu/blob/567142e07261b3e615ae8850b30f4421f455cc5d/shenyu-plugin/shenyu-plugin-httpclient/src/main/java/org/apache/shenyu/plugin/httpclient/config/HttpClientProperties.java#L1134-L1161","documentation":"HttpClientProperties loads the configured key store (keyStorePath) into a KeyStore instance for client-certificate (mTLS) setup. Any failure opening or parsing the store — including wrong password or corrupt file, all caught as Exception — is rethrown as ShenyuException 'Could not load key store path '<path>'' (note the message includes a leading space before the path).","triggerScenarios":"keyStore.load(url.openStream(), keyPassword) fails: the keyStorePath doesn't exist or isn't readable, the keyStorePassword is wrong (Integrity check failed), the file format doesn't match keyStoreType (JKS vs PKCS12), or the store is corrupt.","commonSituations":"PKCS12 file configured with type JKS, typo'd or stale password after rotation, cert not mounted in the container, relative path resolved against the wrong working directory, key store generated by a newer tool with an incompatible format.","solutions":["Verify keyStorePath points to an existing, readable file (prefer an absolute path) and that it is actually mounted in the runtime environment.","Confirm keyStorePassword matches the store's password.","Match keyStoreType to the file format (PKCS12 for .p12/.pfx, JKS for .jks) — modern default is PKCS12.","Validate the store independently with keytool -list -keystore <path> to reproduce the real cause; check the wrapped exception for details."],"exampleFix":"// before\nshenyu.httpclient.ssl.key-store-path: /etc/ssl/client.p12\nshenyu.httpclient.ssl.key-store-type: JKS\n// after\nshenyu.httpclient.ssl.key-store-path: /etc/ssl/client.p12\nshenyu.httpclient.ssl.key-store-type: PKCS12","handlingStrategy":"validation","validationCode":"File ks = new File(keyStorePath);\nif (!ks.isFile() || !ks.canRead()) {\n  throw new IllegalStateException(\"key store not readable: \" + ks.getAbsolutePath());\n}\n// independently verify password + type:\n// keytool -list -keystore /etc/ssl/client.p12 -storetype PKCS12 -storepass $PASS","typeGuard":null,"tryCatchPattern":"try {\n  keyStore = loadKeyStore(keyStorePath, keyStorePassword, keyStoreType);\n} catch (ShenyuException e) {\n  log.error(\"key store load failed for {}: check path, password, and store type\", keyStorePath, e);\n  throw e;\n}","preventionTips":["Match keyStoreType to the file format (PKCS12 vs JKS).","Verify the store with keytool -list using the production password before deploying.","Use absolute paths and confirm mounts exist in the runtime environment.","Validate the password at startup so rotations surface immediately."],"tags":["tls","keystore","configuration"],"backgroundTag":"file-read-failed","analyzedSha":"567142e07261b3e615ae8850b30f4421f455cc5d","analyzedAt":"2026-09-12T10:08:21.293Z","contentChangedAt":"2026-09-12T10:08:21.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}