{"record":{"id":"7bcca82bb070d5ba","repo":"apache/pulsar","slug":"logctx-failed-to-load-public-key-keyname-e","errorCode":null,"errorMessage":"${logCtx}Failed to load public key ${keyName}. ${e.getMessage()}","messagePattern":"(.+?)Failed to load public key (.+?)\\. (.+?)","errorType":"exception","errorClass":"PulsarClientException.CryptoException","httpStatus":null,"severity":"error","filePath":"pulsar-client-messagecrypto-bc/src/main/java/org/apache/pulsar/client/impl/crypto/MessageCryptoBc.java","lineNumber":386,"sourceCode":"        }\n    }\n\n    private void addPublicKeyCipher(String keyName, CryptoKeyReader keyReader) throws CryptoException {\n        if (keyName == null || keyReader == null) {\n            throw new PulsarClientException.CryptoException(\"Keyname or KeyReader is null\");\n        }\n\n        // Read the public key and its info using callback\n        EncryptionKeyInfo keyInfo = keyReader.getPublicKey(keyName, null);\n\n        PublicKey pubKey;\n\n        try {\n            pubKey = loadPublicKey(keyInfo.getKey());\n        } catch (Exception e) {\n            String msg = logCtx + \"Failed to load public key \" + keyName + \". \" + e.getMessage();\n            log.error(msg);\n            throw new PulsarClientException.CryptoException(msg);\n        }\n\n        Cipher dataKeyCipher;\n        byte[] encryptedKey;\n        try {\n            AlgorithmParameterSpec params = null;\n            // Encrypt data key using public key\n            if (RSA.equals(pubKey.getAlgorithm())) {\n                dataKeyCipher = Cipher.getInstance(RSA_TRANS, bcProvider());\n            } else if (ECDSA.equals(pubKey.getAlgorithm())) {\n                dataKeyCipher = Cipher.getInstance(ECIES, bcProvider());\n                params = createIESParameterSpec();\n            } else {\n                String msg = logCtx + \"Unsupported key type \" + pubKey.getAlgorithm() + \" for key \" + keyName;\n                log.error(msg);\n                throw new PulsarClientException.CryptoException(msg);\n            }\n            if (params != null) {","sourceCodeStart":368,"sourceCodeEnd":404,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-client-messagecrypto-bc/src/main/java/org/apache/pulsar/client/impl/crypto/MessageCryptoBc.java#L368-L404","documentation":"This is a wrapping error: addPublicKeyCipher loaded the key bytes from the CryptoKeyReader and passed them to loadPublicKey, which failed (bad PEM format, unsupported curve, non-EC/RSA content, parse error). The code logs and rethrows the failure as a CryptoException prefixed with 'Failed to load public key <keyName>', embedding the underlying exception message.","triggerScenarios":"addPublicKeyCipher is invoked with a keyName whose keyReader.getPublicKey(keyName, null) returns bytes that loadPublicKey cannot parse: invalid PEM, DER structure errors, unsupported EC curve OID (see the PEMException cases), or a key format not matching RSA/EC expectations.","commonSituations":"Key name passed to addEncryptionKey does not match a key file in the CryptoKeyReader directory; the public key file contains a private key or certificate instead of a PUBLIC KEY PEM block; key file corrupted in transit; unsupported curve; whitespace/encoding mangling from secret-management tooling.","solutions":["Read the embedded cause message in the exception and fix the underlying parse failure it reports","Verify the key file contains a valid PEM block starting with '-----BEGIN PUBLIC KEY-----' (or EC PARAMETERS followed by EC PUBLIC KEY)","Confirm the keyName passed to addEncryptionKey exactly matches the key file name the CryptoKeyReader resolves","Test parsing locally: openssl pkey -pubin -in key.pem -text -noout to confirm the key is loadable and of a supported type (RSA or EC on a named curve)"],"exampleFix":"// before: certificate passed where a public key is expected\nCryptoKeyReader reader = new DefaultCryptoKeyReader(\"/certs/server.crt\");\n// after: extract the public key PEM\n// openssl x509 -in server.crt -pubkey -noout > public.key\nCryptoKeyReader reader = new DefaultCryptoKeyReader(\"/certs/public.key\");","handlingStrategy":"try-catch","validationCode":"// Pre-validate the key material served by the reader\nbyte[] keyBytes = keyReader.getPublicKey(keyName, null).getKey();\nString pem = new String(keyBytes, StandardCharsets.UTF_8);\nif (!pem.contains(\"BEGIN PUBLIC KEY\") && !pem.contains(\"BEGIN EC PUBLIC KEY\")) {\n    throw new IllegalStateException(keyName + \" does not contain a public key PEM block\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    crypto.addPublicKeyCipher(keyName, keyReader);\n} catch (PulsarClientException.CryptoException e) {\n    // message embeds the underlying load failure; surface it with key context\n    throw new IllegalStateException(\"Public key '\" + keyName + \"' failed to load: \" + e.getMessage(), e);\n}","preventionTips":["Ensure key file names on disk exactly match the names passed to addEncryptionKey","Distribute PEM public keys (not certificates or private keys) to the KeyReader path","Verify keys after secret-manager injection; some tooling mangles newlines/encoding","Smoke-test key parsing at service startup"],"tags":["crypto","pem","key-parsing","encryption","wrapped-exception"],"backgroundTag":"invalid-public-key-pem","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}