{"record":{"id":"8d744c507e08ac5e","repo":"alibaba/druid","slug":"failed-to-decrypt","errorCode":null,"errorMessage":"Failed to decrypt.","messagePattern":"Failed to decrypt\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/com/alibaba/druid/filter/config/ConfigFilter.java","lineNumber":203,"sourceCode":"            if (encryptedPassword == null || encryptedPassword.length() == 0) {\n                encryptedPassword = dataSource.getConnectProperties().getProperty(DruidDataSourceFactory.PROP_PASSWORD);\n            }\n\n            if (encryptedPassword == null || encryptedPassword.length() == 0) {\n                encryptedPassword = dataSource.getPassword();\n            }\n\n            PublicKey publicKey = getPublicKey(dataSource.getConnectProperties(), info);\n\n            String passwordPlainText = ConfigTools.decrypt(publicKey, encryptedPassword);\n\n            if (info != null) {\n                info.setProperty(DruidDataSourceFactory.PROP_PASSWORD, passwordPlainText);\n            } else {\n                dataSource.setPassword(passwordPlainText);\n            }\n        } catch (Exception e) {\n            throw new IllegalArgumentException(\"Failed to decrypt.\", e);\n        }\n    }\n\n    public PublicKey getPublicKey(Properties connectionProperties, Properties configFileProperties) {\n        String key = null;\n        if (configFileProperties != null) {\n            key = configFileProperties.getProperty(CONFIG_KEY);\n        }\n\n        if (StringUtils.isEmpty(key) && connectionProperties != null) {\n            key = connectionProperties.getProperty(CONFIG_KEY);\n        }\n\n        if (StringUtils.isEmpty(key)) {\n            key = System.getProperty(SYS_PROP_CONFIG_KEY);\n        }\n\n        return ConfigTools.getPublicKey(key);","sourceCodeStart":185,"sourceCodeEnd":221,"githubUrl":"https://github.com/alibaba/druid/blob/fa8dc9912637a2f729eef9f55356621fec18d40e/core/src/main/java/com/alibaba/druid/filter/config/ConfigFilter.java#L185-L221","documentation":"ConfigFilter.decrypt wraps ANY exception during password decryption as IllegalArgumentException. The decrypt flow resolves an encrypted password (from info properties, connect properties, or dataSource password), resolves the public key, and calls ConfigTools.decrypt(publicKey, cipherText). Failure means the cipher text is not a valid RSA-encrypted password for the supplied/default public key, or the encrypted password was missing.","triggerScenarios":"config.decrypt is enabled and the password is encrypted with a different public key than the one configured (or the Druid default); the encrypted password string is truncated/corrupt; no encrypted password is present at all; the RSA provider is unavailable.","commonSituations":"Password was encrypted with a custom public key but config.decrypt.key was not set (so Druid falls back to DEFAULT_PUBLIC_KEY_STRING); copy-paste truncation of the cipher text; re-keying without re-encrypting stored passwords; running on a JDK without the SunRsaSign provider.","solutions":["Re-encrypt the password with ConfigTools using the same public key you configure via config.decrypt.key.","Confirm config.decrypt.key matches the publicKey printed by ConfigTools.encrypt when the password was generated.","Verify the encrypted password string is complete (Base64, no line breaks/whitespace) and that config.decrypt=true is set.","Ensure the JDK provides the RSA provider (SunRsaSign)."],"exampleFix":"// before\n// password encrypted with custom key, but config.decrypt.key omitted\n\n// after\n// java -cp druid.jar com.alibaba.druid.filter.config.ConfigTools yourpassword\n// then set config.decrypt.key=<printed publicKey> and password=<printed cipher>","handlingStrategy":"validation","validationCode":"// Pre-decrypt in a test/main to prove key<->ciphertext match:\n// String plain = ConfigTools.decrypt(configuredPublicKey, encryptedPassword);\n// If that throws, regenerate the cipher with ConfigTools using the configured key.","typeGuard":null,"tryCatchPattern":"try {\n    ds.setFilters(\"config\"); ds.init();\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().equals(\"Failed to decrypt.\")) {\n        // ensure config.decrypt.key matches the key used to encrypt; re-encrypt if needed\n    }\n    throw e;\n}","preventionTips":["Always pair config.decrypt.key with the exact publicKey printed when the password was encrypted.","Store the encrypted password as a single unbroken Base64 string.","Re-encrypt all stored passwords whenever you rotate the RSA key pair."],"tags":["config-filter","encryption","rsa","password","configuration"],"backgroundTag":null,"analyzedSha":"fa8dc9912637a2f729eef9f55356621fec18d40e","analyzedAt":"2026-08-14T04:55:06.789Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}