{"record":{"id":"5bb432ec3c282c35","repo":"spring-projects/spring-security","slug":"cannot-load-keys-from-store","errorCode":null,"errorMessage":"Cannot load keys from store: ","messagePattern":"Cannot load keys from store: ","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"critical","filePath":"crypto/src/main/java/org/springframework/security/crypto/encrypt/KeyStoreKeyFactory.java","lineNumber":96,"sourceCode":"\t\t\t\t\t\t\tthis.store.load(stream, this.password);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\tRSAPrivateCrtKey key = (RSAPrivateCrtKey) this.store.getKey(alias, password);\n\t\t\tCertificate certificate = this.store.getCertificate(alias);\n\t\t\tPublicKey publicKey = null;\n\t\t\tif (certificate != null) {\n\t\t\t\tpublicKey = certificate.getPublicKey();\n\t\t\t}\n\t\t\telse if (key != null) {\n\t\t\t\tRSAPublicKeySpec spec = new RSAPublicKeySpec(key.getModulus(), key.getPublicExponent());\n\t\t\t\tpublicKey = KeyFactory.getInstance(\"RSA\").generatePublic(spec);\n\t\t\t}\n\t\t\treturn new KeyPair(publicKey, key);\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new IllegalStateException(\"Cannot load keys from store: \" + this.resource, ex);\n\t\t}\n\t}\n\n}\n","sourceCodeStart":78,"sourceCodeEnd":101,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/crypto/src/main/java/org/springframework/security/crypto/encrypt/KeyStoreKeyFactory.java#L78-L101","documentation":"KeyStoreKeyFactory.getKeyPair() loads a KeyStore from the configured Resource and extracts an RSA key pair; any exception during load, password check, alias lookup, or key reconstruction is wrapped in this IllegalStateException. It means the keystore could not be read or the requested keys could not be produced from it. The original cause (password, IO, UnrecoverableKeyException) is attached as the cause.","triggerScenarios":"Calling new KeyStoreKeyFactory(resource, password).getKeyPair() where the resource path does not exist, the store password is wrong, the key password/alias does not match, or the store entry is not an RSA PrivateKey with a usable certificate.","commonSituations":"Wrong keystore path on classpath vs filesystem; keytool-generated store with a different key password than store password; missing BouncyCastle provider for non-JKS formats (PKCS12 legacy); alias typo; JVM keystore type defaults changing (JKS vs PKCS12).","solutions":["Verify the keystore resource path resolves and the file exists on the classpath/filesystem","Confirm the store password is correct; pass a KeyStoreCallbackFactory/password if key password differs from store password","Check the alias exists: keytool -list -keystore store.jks and use the exact alias","Ensure the store type/provider matches the file format (JKS vs PKCS12), e.g. load with Keystore.getInstance(\"PKCS12\") compatible config"],"exampleFix":"// before\nKeyPair kp = new KeyStoreKeyFactory(new ClassPathResource(\"keystore.jks\"), \"wrongpass\").getKeyPair(\"mykey\");\n// after\nClassPathResource res = new ClassPathResource(\"keystore.jks\");\nAssert.state(res.exists(), \"keystore missing\");\nKeyPair kp = new KeyStoreKeyFactory(res, \"correct-store-pass\").getKeyPair(\"mykey\");","handlingStrategy":"validation","validationCode":"Resource res = new ClassPathResource(\"keystore.jks\");\nAssert.state(res.exists(), \"keystore file missing\");\ntry (InputStream in = res.getInputStream()) {\n    KeyStore.getInstance(\"JKS\").load(in, password.toCharArray()); // fails early with a precise error\n}","typeGuard":null,"tryCatchPattern":"try { KeyPair kp = factory.getKeyPair(alias); } catch (IllegalStateException ex) { throw new ConfigurationException(\"Keystore load failed: \" + ex.getCause(), ex); }","preventionTips":["Verify keystore path and alias with keytool -list before deploying","Use distinct store/key passwords knowingly; pass the key password if it differs","Pin the keystore type (JKS vs PKCS12) explicitly","Add keystore presence check to application startup validation"],"tags":["keystore","crypto","configuration","rsa"],"backgroundTag":"keystore-load-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}