{"record":{"id":"8fa8710cbb186698","repo":"apache/pulsar","slug":"failed-to-set-encryption-keys","errorCode":null,"errorMessage":"Failed to set encryption keys","messagePattern":"Failed to set encryption keys","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-broker/src/main/java/org/apache/pulsar/client/impl/RawBatchMessageContainerImpl.java","lineNumber":165,"sourceCode":"            EncryptionContext encryptionContext = (EncryptionContext) lastMessage.getEncryptionCtx().get();\n\n            if (cryptoKeyReader == null) {\n                IllegalStateException ex =\n                        new IllegalStateException(\"Messages are encrypted but no cryptoKeyReader is provided.\");\n                discard(ex);\n                throw ex;\n            }\n\n            encryptionKeys = encryptionContext.getKeys().keySet();\n            if (msgCrypto == null) {\n                msgCrypto =\n                        new MessageCryptoBc(String.format(\n                                \"[%s] [%s]\", topicName, \"RawBatchMessageContainer\"), true);\n                try {\n                    msgCrypto.addPublicKeyCipher(encryptionKeys, cryptoKeyReader);\n                } catch (PulsarClientException.CryptoException e) {\n                    discard(e);\n                    throw new IllegalArgumentException(\"Failed to set encryption keys\", e);\n                }\n            }\n        }\n\n        ByteBuf encryptedPayload = encrypt(getCompressedBatchMetadataAndPayload(false));\n        updateAndReserveBatchAllocatedSize(encryptedPayload.capacity());\n        ByteBuf metadataAndPayload = Commands.serializeMetadataAndPayload(Commands.ChecksumType.Crc32c,\n                messageMetadata, encryptedPayload);\n\n        MessageIdData idData = new MessageIdData();\n        idData.setLedgerId(lastMessageId.getLedgerId());\n        idData.setEntryId(lastMessageId.getEntryId());\n        idData.setPartition(lastMessageId.getPartitionIndex());\n\n        // Format: [IdSize][Id][metadataAndPayloadSize][metadataAndPayload]\n        // Following RawMessage.serialize() format as the compacted messages will be parsed as RawMessage in broker\n        int idSize = idData.getSerializedSize();\n        int headerSize = 4 /* IdSize */ + idSize + 4 /* metadataAndPayloadSize */;","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-broker/src/main/java/org/apache/pulsar/client/impl/RawBatchMessageContainerImpl.java#L147-L183","documentation":"RawBatchMessageContainerImpl.toByteBuf: while preparing an encrypted batch, setting the encryption keys from the message's encryption context failed — typically because the crypto key reader or encryption context is missing/invalid, and the batch is discarded.","triggerScenarios":"Thrown at pulsar-broker/src/main/java/org/apache/pulsar/client/impl/RawBatchMessageContainerImpl.java:165 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide a valid cryptoKeyReader for encrypted messages","Check that the EncryptionContext keys are accessible and non-empty"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}