{"record":{"id":"933820536cb2406d","repo":"languagetool-org/languagetool","slug":"could-not-set-up-ssl-context","errorCode":null,"errorMessage":"Could not set up SSL context","messagePattern":"Could not set up SSL context","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"languagetool-server/src/main/java/org/languagetool/server/HTTPSServer.java","lineNumber":101,"sourceCode":"      ResourceBundle messages = JLanguageTool.getMessageBundle();\n      String message = Tools.i18n(messages, \"https_server_start_failed_unknown_reason\", host, Integer.toString(port));\n      throw new RuntimeException(message, e);\n    }\n  }\n\n  private SSLContext getSslContext(File keyStoreFile, String passPhrase) {\n    try (FileInputStream keyStoreStream = new FileInputStream(keyStoreFile)) {\n      KeyStore keystore = KeyStore.getInstance(\"JKS\");\n      keystore.load(keyStoreStream, passPhrase.toCharArray());\n      KeyManagerFactory kmf = KeyManagerFactory.getInstance(\"SunX509\");\n      kmf.init(keystore, passPhrase.toCharArray());\n      TrustManagerFactory tmf = TrustManagerFactory.getInstance(\"SunX509\");\n      tmf.init(keystore);\n      SSLContext sslContext = SSLContext.getInstance(\"TLS\");\n      sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);\n      return sslContext;\n    } catch (Exception e) {\n      throw new RuntimeException(\"Could not set up SSL context\", e);\n    }\n  }\n\n  private HttpsConfigurator getConfigurator(SSLContext sslContext) {\n    return new HttpsConfigurator(sslContext) {\n          @Override\n          public void configure (HttpsParameters params) {\n            SSLContext context = getSSLContext();\n            SSLParameters sslParams = context.getDefaultSSLParameters();\n            params.setNeedClientAuth(false);\n            params.setSSLParameters(sslParams);\n          }\n        };\n  }\n\n  @Override\n  public void stop() {\n    super.stop();","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/languagetool-org/languagetool/blob/2e990059ce67d5e2a0f7f7ca5d31160c6709df4b/languagetool-server/src/main/java/org/languagetool/server/HTTPSServer.java#L83-L119","documentation":"getSslContext loads the JKS keystore, builds KeyManagerFactory/TrustManagerFactory and initializes a TLS SSLContext; any Exception in that chain (file not found, wrong password, bad keystore format, missing TLS provider) is rethrown as RuntimeException('Could not set up SSL context').","triggerScenarios":"Keystore file does not exist or is unreadable; keystore is not a valid JKS file; password is wrong; JDK lacks the SunX509/TLS algorithms (unusual JVM/provider).","commonSituations":"Config points to a PEM file instead of JKS; typos in keystore path in server.properties; PKCS12 file renamed to .jks; corrupted keystore.","solutions":["Verify the keystore file path exists and is readable by the server process.","Confirm the file is really JKS format; convert if needed with keytool -importkeystore.","Check the 'password' property matches the keystore's password.","Validate the keystore with: keytool -list -keystore server.jks.","Update to a JDK that supports the required TLS version/algorithms."],"exampleFix":"// before\nkeystore = /etc/ssl/cert.pem   // PEM, not JKS\n// after\nkeytool -importkeystore -srckeystore cert.pem -destkeystore server.jks -deststoretype JKS\n# server.properties\nkeystore = /etc/ssl/server.jks","handlingStrategy":"try-catch","validationCode":"// validate keystore before starting server\nKeyStore ks = KeyStore.getInstance(\"JKS\");\ntry (FileInputStream in = new FileInputStream(keystoreFile)) {\n  ks.load(in, password.toCharArray()); // throws here, before server start\n}","typeGuard":null,"tryCatchPattern":"try {\n  server = new HTTPSServer(config, false, host, ips);\n} catch (RuntimeException e) {\n  if (e.getMessage().contains(\"SSL context\")) {\n    log.error(\"Check keystore path/format/password: {}\", e.getCause());\n  }\n}","preventionTips":["Confirm the keystore is JKS (keytool -list) and not a renamed PEM/PKCS12","Verify the password matches both store and key passwords","Ensure the server process has read access to the keystore file","Regenerate/convert certs with keytool after every renewal"],"tags":["ssl","keystore","https","configuration"],"backgroundTag":"ssl-context-init-failed","analyzedSha":"2e990059ce67d5e2a0f7f7ca5d31160c6709df4b","analyzedAt":"2026-09-06T09:20:17.015Z","contentChangedAt":"2026-09-06T09:20:17.015Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}