{"record":{"id":"7d2abcc66be3d91c","repo":"spring-projects/spring-boot","slug":"error-adding-certificates-to-keystore","errorCode":null,"errorMessage":"Error adding certificates to KeyStore: {}","messagePattern":"Error adding certificates to KeyStore: (.+?)","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"buildpack/spring-boot-buildpack-platform/src/main/java/org/springframework/boot/buildpack/platform/docker/ssl/KeyStoreFactory.java","lineNumber":63,"sourceCode":"\t/**\n\t * Create a new {@link KeyStore} populated with the certificate stored at the\n\t * specified file path and an optional private key.\n\t * @param certPath the path to the certificate authority file\n\t * @param keyPath the path to the private file\n\t * @param alias the alias to use for KeyStore entries\n\t * @return the {@code KeyStore}\n\t */\n\tstatic KeyStore create(Path certPath, @Nullable Path keyPath, String alias) {\n\t\ttry {\n\t\t\tKeyStore keyStore = getKeyStore();\n\t\t\tString certificateText = Files.readString(certPath);\n\t\t\tList<X509Certificate> certificates = PemCertificateParser.parse(certificateText);\n\t\t\tPrivateKey privateKey = getPrivateKey(keyPath);\n\t\t\ttry {\n\t\t\t\taddCertificates(keyStore, certificates.toArray(X509Certificate[]::new), privateKey, alias);\n\t\t\t}\n\t\t\tcatch (KeyStoreException ex) {\n\t\t\t\tthrow new IllegalStateException(\"Error adding certificates to KeyStore: \" + ex.getMessage(), ex);\n\t\t\t}\n\t\t\treturn keyStore;\n\t\t}\n\t\tcatch (GeneralSecurityException | IOException ex) {\n\t\t\tthrow new IllegalStateException(\"Error creating KeyStore: \" + ex.getMessage(), ex);\n\t\t}\n\t}\n\n\tprivate static KeyStore getKeyStore()\n\t\t\tthrows KeyStoreException, IOException, NoSuchAlgorithmException, CertificateException {\n\t\tKeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());\n\t\tkeyStore.load(null);\n\t\treturn keyStore;\n\t}\n\n\tprivate static @Nullable PrivateKey getPrivateKey(@Nullable Path path) throws IOException {\n\t\tif (path != null && Files.exists(path)) {\n\t\t\tString text = Files.readString(path);","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/spring-projects/spring-boot/blob/270dfe353fb830fd69b823a8a859287ff103854b/buildpack/spring-boot-buildpack-platform/src/main/java/org/springframework/boot/buildpack/platform/docker/ssl/KeyStoreFactory.java#L45-L81","documentation":"KeyStoreFactory.addCertificates calls keyStore.setKeyEntry(alias, privateKey, NO_PASSWORD, certificates) when a private key is present, or keyStore.setCertificateEntry(alias+'-'+i, cert) otherwise. A KeyStoreException means the keystore rejected the entry. The keystore itself was freshly created and loaded empty by getKeyStore(), so the failure is almost always about the cert/key combination rather than keystore state.","triggerScenarios":"addCertificates at lines 90 or 94 throws KeyStoreException: private key does not match the certificate chain (key/cert from different keypairs); alias already present with an incompatible entry type; certificate chain is empty when a privateKey is supplied.","commonSituations":"Supplying a certificate PEM that was issued for a different private key than the one in keyPath; mixing CA certs with a leaf cert from a different keypair; pointing certPath and keyPath at mismatched files.","solutions":["Verify key/cert match: for RSA compare `openssl x509 -noout -modulus -in cert.pem` with `openssl rsa -noout -modulus -in key.pem`; for EC/Ed25519 compare public key fingerprints via `openssl pkey -pubout -in key.pem` vs `openssl x509 -pubkey -noout -in cert.pem`.","Re-issue the certificate from the same private key, or supply a matching key.","Omit keyPath if you only need to trust a CA cert (no private key)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Verify private key and certificate share a public key before calling KeyStoreFactory\nPublicKey certPub = CertificateFactory.getInstance(\"X.509\")\n        .generateCertificate(Files.newInputStream(certPath)).getPublicKey();\nif (keyPath != null && Files.exists(keyPath)) {\n    PrivateKey pk = PemPrivateKeyParser.parse(Files.readString(keyPath));\n    if (!Arrays.equals(pk.getEncoded(), /* derive */ pk.getEncoded())\n            && !certPub.getAlgorithm().equals(pk.getAlgorithm())) {\n        throw new IllegalArgumentException(\"Certificate and private key do not match.\");\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    KeyStoreFactory.create(certPath, keyPath, alias);\n} catch (IllegalStateException ex) {\n    if (ex.getCause() instanceof KeyStoreException\n            && ex.getMessage().startsWith(\"Error adding certificates to KeyStore\")) {\n        // hint: verify key/cert match with openssl\n    }\n    throw ex;\n}","preventionTips":["Always generate the CSR from the same private key that will be paired with the cert.","Verify key/cert match with openssl (modulus or public-key fingerprint) before deploying.","Keep cert and key files paired and versioned together."],"tags":["docker","ssl","tls","keystore","certificate","buildpack"],"backgroundTag":null,"analyzedSha":"270dfe353fb830fd69b823a8a859287ff103854b","analyzedAt":"2026-08-11T19:42:06.541Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}