{"record":{"id":"60cdcb0c12b41737","repo":"alibaba/druid","slug":"failed-to-get-public-key","errorCode":null,"errorMessage":"Failed to get public key","messagePattern":"Failed to get public key","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/com/alibaba/druid/filter/config/ConfigTools.java","lineNumber":90,"sourceCode":"\n        return decrypt(publicKey, cipherText);\n    }\n\n    public static PublicKey getPublicKeyByX509(String x509File) {\n        if (x509File == null || x509File.length() == 0) {\n            return ConfigTools.getPublicKey(null);\n        }\n\n        FileInputStream in = null;\n        try {\n            in = new FileInputStream(x509File);\n\n            CertificateFactory factory = CertificateFactory\n                    .getInstance(\"X.509\");\n            Certificate cer = factory.generateCertificate(in);\n            return cer.getPublicKey();\n        } catch (Exception e) {\n            throw new IllegalArgumentException(\"Failed to get public key\", e);\n        } finally {\n            JdbcUtils.close(in);\n        }\n    }\n\n    public static PublicKey getPublicKey(String publicKeyText) {\n        if (publicKeyText == null || publicKeyText.length() == 0) {\n            publicKeyText = ConfigTools.DEFAULT_PUBLIC_KEY_STRING;\n        }\n\n        try {\n            byte[] publicKeyBytes = Base64.base64ToByteArray(publicKeyText);\n            X509EncodedKeySpec x509KeySpec = new X509EncodedKeySpec(\n                    publicKeyBytes);\n\n            KeyFactory keyFactory = KeyFactory.getInstance(\"RSA\", \"SunRsaSign\");\n            return keyFactory.generatePublic(x509KeySpec);\n        } catch (Exception e) {","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/alibaba/druid/blob/fa8dc9912637a2f729eef9f55356621fec18d40e/core/src/main/java/com/alibaba/druid/filter/config/ConfigTools.java#L72-L108","documentation":"ConfigTools.getPublicKeyByX509 reads an X.509 certificate file and extracts its public key. Any failure (file not found, IOException, CertificateException from CertificateFactory.getInstance(\"X.509\") or generateCertificate, or the certificate carrying no key) is wrapped as IllegalArgumentException(\"Failed to get public key\"). The FileInputStream is closed in finally.","triggerScenarios":"getPublicKeyByX509(x509File) is called with a path that does not exist, is unreadable, is not a valid DER/PEM X.509 certificate, or whose certificate factory cannot be instantiated.","commonSituations":"Pointing config key file at a non-certificate (e.g. a raw RSA key or a PKCS8 file) by mistake; wrong path; permission denied; a PEM file that is not a certificate block.","solutions":["Confirm the file is a valid X.509 certificate (openssl x509 -in file -noout -text succeeds).","Use getPublicKeyByPublicKeyFile or getPublicKey(String) instead if you have a raw Base64 RSA public key, not a certificate.","Check the path is absolute or resolvable from the JVM working directory and that the JVM can read it."],"exampleFix":"// before\n// ConfigTools.getPublicKeyByX509(\"/etc/app/server-pkcs8.der\") // not a cert\n\n// after\n// ConfigTools.getPublicKeyByPublicKeyFile(\"/etc/app/pubkey.txt\") // raw X509-encoded key","handlingStrategy":"validation","validationCode":"java.security.cert.Certificate c;\ntry (java.io.InputStream in = new java.io.FileInputStream(x509File)) {\n    c = java.security.cert.CertificateFactory.getInstance(\"X.509\").generateCertificate(in);\n    c.getPublicKey(); // prove it parses before wiring\n} catch (Exception e) { throw new IllegalArgumentException(\"bad cert file\", e); }","typeGuard":null,"tryCatchPattern":"try {\n    PublicKey pk = ConfigTools.getPublicKeyByX509(x509File);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().equals(\"Failed to get public key\")) {\n        // verify file is a real X.509 cert: openssl x509 -in file -noout -text\n    }\n    throw e;\n}","preventionTips":["Use getPublicKey(String) with a Base64 key unless you specifically have an X.509 certificate.","Validate certificates with openssl before referencing them in config.","Keep cert files under strict read permissions."],"tags":["config-tools","x509","certificate","io","encryption"],"backgroundTag":null,"analyzedSha":"fa8dc9912637a2f729eef9f55356621fec18d40e","analyzedAt":"2026-08-14T04:55:06.789Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}