{"record":{"id":"6781ea6d370bd9ca","repo":"karatelabs/karate","slug":"failed-to-create-ssl-context-from-files-message","errorCode":null,"errorMessage":"failed to create SSL context from files: <message>","messagePattern":"failed to create SSL context from files: <message>","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"karate-core/src/main/java/io/karatelabs/core/SslUtils.java","lineNumber":113,"sourceCode":"            java.util.Date notAfter = new java.util.Date(notBefore.getTime() + (86400000L * VALIDITY_DAYS));\n\n            @SuppressWarnings(\"deprecation\")\n            SelfSignedCertificate ssc = new SelfSignedCertificate(\"localhost\", notBefore, notAfter);\n\n            return SslContextBuilder.forServer(ssc.certificate(), ssc.privateKey()).build();\n        } catch (Exception e) {\n            throw new RuntimeException(\"failed to generate Netty SSL context: \" + e.getMessage(), e);\n        }\n    }\n\n    /**\n     * Create a Netty SslContext from PEM files.\n     */\n    public static SslContext createNettySslContext(File certFile, File keyFile) {\n        try {\n            return SslContextBuilder.forServer(certFile, keyFile).build();\n        } catch (Exception e) {\n            throw new RuntimeException(\"failed to create SSL context from files: \" + e.getMessage(), e);\n        }\n    }\n\n    /**\n     * Create a Netty SslContext from PEM file paths.\n     */\n    public static SslContext createNettySslContext(String certPath, String keyPath) {\n        return createNettySslContext(new File(certPath), new File(keyPath));\n    }\n\n    /**\n     * Load private key from a PEM file.\n     */\n    private static java.security.PrivateKey loadPrivateKeyFromFile(File keyFile) throws Exception {\n        byte[] keyBytes = java.nio.file.Files.readAllBytes(keyFile.toPath());\n        String keyString = new String(keyBytes, java.nio.charset.StandardCharsets.UTF_8);\n\n        // Remove PEM headers/footers and decode","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/karatelabs/karate/blob/a22eb90246d958d15a47bf436693d0121ad2812d/karate-core/src/main/java/io/karatelabs/core/SslUtils.java#L95-L131","documentation":"Karate failed to build a Netty SslContext from the supplied PEM certificate and private key files. SslContextBuilder.forServer(certFile, keyFile).build() throws for malformed/unreadable PEM content, mismatched cert/key pairs, or unsupported key formats, and this method wraps that failure in a RuntimeException keeping the original cause.","triggerScenarios":"Calling SslUtils.createNettySslContext(File certFile, File keyFile) — or configuring a mock server with cert/key files — when the PEM files are missing, unreadable, encrypted (password-protected), not valid PEM, or the certificate does not match the private key.","commonSituations":"Passing a PKCS#12 (.p12) file where PEM is expected; certificate and key from different pairs; key encrypted with a passphrase Karate does not supply; file path typos in test config; Java unable to find an SSL provider on minimal JREs.","solutions":["Read the wrapped cause — it names the parsing/provider error (e.g. 'no certificate found', 'key mismatch')","Verify both files exist, are readable, and are PEM-encoded (BEGIN CERTIFICATE / BEGIN PRIVATE KEY headers)","Confirm the certificate and key belong to the same pair (compare public key / modulus)","Decrypt password-protected keys or strip the passphrase (openssl rsa -in key.pem -out key-nopass.pem)","Convert other formats to PEM (openssl x509 / openssl pkcs8) and retry"],"exampleFix":"// before: PKCS#12 file passed as PEM\nSslUtils.createNettySslContext(new File(\"server.p12\"), new File(\"server.key\"));\n// after: convert to PEM first, then pass PEM files\n// openssl pkcs12 -in server.p12 -clcerts -nokeys -out server.crt\n// openssl pkcs12 -in server.p12 -nocerts -nodes -out server.key\nSslUtils.createNettySslContext(new File(\"server.crt\"), new File(\"server.key\"));","handlingStrategy":"validation","validationCode":"// verify PEM inputs before building the SSL context\nstatic boolean validPemPair(File cert, File key) {\n    try {\n        String c = java.nio.file.Files.readString(cert.toPath());\n        String k = java.nio.file.Files.readString(key.toPath());\n        return c.contains(\"BEGIN CERTIFICATE\") && (k.contains(\"BEGIN PRIVATE KEY\") || k.contains(\"BEGIN RSA PRIVATE KEY\") || k.contains(\"BEGIN EC PRIVATE KEY\"));\n    } catch (Exception e) { return false; }\n}","typeGuard":null,"tryCatchPattern":"try { SslContext ctx = SslUtils.createNettySslContext(certFile, keyFile); } catch (RuntimeException e) { throw new IllegalStateException(\"check PEM cert/key files: \" + e.getCause().getMessage(), e); }","preventionTips":["Always ship PEM (not PKCS#12) cert/key for TLS config","Verify cert and key come from the same pair","Strip passphrases from keys used in automated tests"],"tags":["ssl","netty","pem","certificate","file"],"backgroundTag":"invalid-config-value","analyzedSha":"a22eb90246d958d15a47bf436693d0121ad2812d","analyzedAt":"2026-09-12T09:01:00.220Z","contentChangedAt":"2026-09-12T09:01:00.220Z","schemaVersion":2},"datasetVersion":"2026-09-16T19:17:19.609Z"}