{"record":{"id":"6a618d26786285d3","repo":"pentaho/pentaho-kettle","slug":"rest-error-keymanagementexception","errorCode":"Rest.Error.KeyManagementException","errorMessage":"Rest.Error.KeyManagementException","messagePattern":"Rest\\.Error\\.KeyManagementException","errorType":"exception","errorClass":"KettleException","httpStatus":null,"severity":"error","filePath":"plugins/rest/core/src/main/java/org/pentaho/di/trans/steps/rest/Rest.java","lineNumber":375,"sourceCode":"\n  protected void setSSLConfiguration( RestData data ) throws KettleException {\n    try ( var trustStoreIn = getInputStream( data.trustStoreFile ) ) {\n      data.sslContext = HttpClientManager.getSslContext( meta.isIgnoreSsl(),\n        trustStoreIn,\n        data.trustStorePassword );\n\n    } catch ( NoSuchAlgorithmException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.NoSuchAlgorithm\" ), e );\n    } catch ( KeyStoreException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.KeyStoreException\" ), e );\n    } catch ( CertificateException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.CertificateException\" ), e );\n    } catch ( FileNotFoundException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.FileNotFound\", data.trustStoreFile ), e );\n    } catch ( IOException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.IOException\" ), e );\n    } catch ( KeyManagementException | UnrecoverableKeyException e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"Rest.Error.KeyManagementException\" ), e );\n    }\n  }\n\n  /**\n   * Get an InputStream for the file with the given name.\n   * If the file name is empty or null, returns null.\n   *\n   * @param fileName the file name to get InputStream from\n   * @return InputStream for the given file, <code>null</code> if the given file name is empty or null\n   * @throws KettleException if any error occurs while getting the InputStream\n   */\n  protected InputStream getInputStream( String fileName ) throws KettleException {\n    InputStream inputStream = null;\n\n    if ( !StringUtil.isEmpty( fileName ) ) {\n      fileName = fileName.trim();\n      if ( !StringUtil.isEmpty( fileName ) ) {\n        inputStream = KettleVFS.getInstance( this.getTransMeta().getBowl() ).getInputStream( fileName );","sourceCodeStart":357,"sourceCodeEnd":393,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/rest/core/src/main/java/org/pentaho/di/trans/steps/rest/Rest.java#L357-L393","documentation":"Wraps KeyManagementException or UnrecoverableKeyException thrown when initializing the SSLContext in setSSLConfiguration (called by setConfig); the localized message is 'Key management error'. It means the JVM could not build the SSL key/trust managers from the supplied key material.","triggerScenarios":"SSLContext.init(...) fails because the key store's key password differs from the store password (UnrecoverableKeyException) or the key algorithm/provider is unavailable (KeyManagementException); occurs whenever the REST step configures a trust store or key store for HTTP client SSL.","commonSituations":"PKCS#12 store where key password != store password; JCE unlimited-strength policy files missing for strong ciphers on old JDKs; key store with keys the default SunX509 algorithm cannot recover; mismatched Java provider versions after a JDK upgrade.","solutions":["Set the step's key store password AND key password to the same value, or re-import the key with keytool so the key password matches the store password.","Check the runtime JDK: install JCE unlimited strength policy files (Java 8 < u161) or upgrade to a JDK that supports the cipher/key used.","Re-generate the key pair with a standard algorithm: keytool -genkeypair -keyalg RSA -keysize 2048.","Enable -javax.net.debug=ssl,handshake and rerun to see which manager initialization fails."],"exampleFix":"// before — key password differs from store password\nkeytool -importkeystore ... -destkeypass othersecret\n// after — same password for store and key\nkeytool -importkeystore -srckeystore client.p12 -destkeystore client.jks -deststorepass secret -destkeypass secret","handlingStrategy":"try-catch","validationCode":"// Verify key material is recoverable before use\nKeyStore ks = KeyStore.getInstance(\"JKS\");\nks.load(new FileInputStream(keyStoreFile), storePass.toCharArray());\nKey key = ks.getKey(alias, keyPass.toCharArray()); // throws UnrecoverableKeyException if wrong\nif (key == null) throw new IllegalStateException(\"Key not recoverable: \" + alias);","typeGuard":null,"tryCatchPattern":"try { setSSLConfiguration(); } catch (KettleException e) {\n  if (e.getCause() instanceof KeyManagementException || e.getCause() instanceof UnrecoverableKeyException) {\n    /* re-check key password / JDK crypto policy */\n  }\n  throw e;\n}","preventionTips":["Use identical store and key passwords when creating key stores.","Keep runtime JDK/JCE policy compatible with the key algorithm and size.","Document which JDK built the store and which JDK consumes it.","Enable javax.net.debug=ssl when first configuring SSL."],"tags":["ssl","keystore","key-management","configuration"],"backgroundTag":"invalid-config-value","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}