{"record":{"id":"6e0866a57c9a27e3","repo":"apache/pulsar","slug":"failed-to-set-the-certificate","errorCode":null,"errorMessage":"Failed to set the certificate","messagePattern":"Failed to set the certificate","errorType":"exception","errorClass":"KeyStoreException","httpStatus":null,"severity":"error","filePath":"pulsar-common/src/main/java/org/apache/pulsar/common/util/KeyStoreHolder.java","lineNumber":99,"sourceCode":"        return keyStore;\n    }\n\n    /**\n     * @return the password this holder's key entries are stored under; a {@code KeyManagerFactory} reading\n     *         them must be initialized with it. A fresh copy is returned on each call and is owned by the\n     *         caller, who should zero it once the factory has consumed it (as\n     *         {@code JdkSslContexts.setupKeyManager} does) rather than leaving the plaintext password\n     *         reachable.\n     */\n    public char[] getEntryPassword() {\n        return Arrays.copyOf(entryPassword, entryPassword.length);\n    }\n\n    public void setCertificate(String alias, Certificate certificate) throws KeyStoreException {\n        try {\n            keyStore.setCertificateEntry(alias, certificate);\n        } catch (GeneralSecurityException e) {\n            throw new KeyStoreException(\"Failed to set the certificate\", e);\n        }\n    }\n\n    public void setPrivateKey(String alias, PrivateKey privateKey, Certificate[] certChain) throws KeyStoreException {\n        try {\n            keyStore.setKeyEntry(alias, privateKey, entryPassword, certChain);\n        } catch (GeneralSecurityException e) {\n            throw new KeyStoreException(\"Failed to set the private key\", e);\n        }\n    }\n\n}\n","sourceCodeStart":81,"sourceCodeEnd":112,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-common/src/main/java/org/apache/pulsar/common/util/KeyStoreHolder.java#L81-L112","documentation":"KeyStoreHolder.setCertificate() wraps any GeneralSecurityException thrown by KeyStore.setCertificateEntry() in a KeyStoreException with the message \"Failed to set the certificate\", keeping the original as cause. This stores a trusted certificate entry under the given alias in the in-memory store.","triggerScenarios":"Calling setCertificate(alias, cert) where the store rejects the entry: alias already holds a key entry, null certificate, or the underlying store type/provider refuses trusted-cert entries.","commonSituations":"Building a TrustManagerFactory trust store from PEM files where the same alias is reused for a private key and then a certificate (or vice versa); passing an invalid/corrupt Certificate object produced by an earlier failed parse; provider-restricted (FIPS) stores.","solutions":["Inspect the cause (e.g. KeyStoreException 'Cannot overwrite own certificate' or 'key entry with alias ...') to determine the conflict.","Use a unique alias per certificate; if the alias is taken by a key entry, delete it first (keyStore.deleteEntry(alias)) or pick a different alias.","Verify the Certificate object is non-null and was parsed successfully before adding it.","Check that the store type/provider in use supports trusted certificate entries."],"exampleFix":"// before\nholder.setCertificate(\"server\", caCert); // fails if \"server\" already holds a key entry\n// after\nholder.setPrivateKey(\"server\", key, chain);\nholder.setCertificate(\"server-ca\", caCert); // distinct alias","handlingStrategy":"try-catch","validationCode":"static void requireAddable(KeyStoreHolder holder, String alias, Certificate cert) throws GeneralSecurityException {\n    Objects.requireNonNull(cert, \"certificate must not be null\");\n    if (holder.getKeyStore().isKeyEntry(alias)) {\n        throw new IllegalArgumentException(\"alias already holds a key entry: \" + alias);\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    holder.setCertificate(alias, cert);\n} catch (KeyStoreException e) {\n    // cause: alias conflict, null/invalid cert, or provider restriction\n    throw new RuntimeException(\"cannot add trusted cert '\" + alias + \"': \" + e.getCause(), e);\n}","preventionTips":["Use a unique alias per certificate; never reuse an alias holding a key entry","Validate the Certificate was parsed non-null before adding","Delete conflicting entries (deleteEntry) before re-adding under the same alias","Check store type/provider supports trusted-cert entries in FIPS environments"],"tags":["security","keystore","tls","certificate"],"backgroundTag":"keystore-entry-rejected","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}