{"record":{"id":"a483fbd517632453","repo":"apache/pulsar","slug":"jcaprovider-providername-supplies-none-of-the","errorCode":null,"errorMessage":"jcaProvider='${providerName}' supplies none of the in-memory carrier keystore types ${IN_MEMORY_STORE_TYPE_PREFERENCE} needed to build the TLS key managers. Types this provider registers: ${registeredTypes}. Unset jcaProvider, or pin a provider that supplies BCFKS or PKCS12.","messagePattern":"jcaProvider='(.+?)' supplies none of the in-memory carrier keystore types (.+?) needed to build the TLS key managers\\. Types this provider registers: (.+?)\\. Unset jcaProvider, or pin a provider that supplies BCFKS or PKCS12\\.","errorType":"exception","errorClass":"KeyStoreException","httpStatus":null,"severity":"error","filePath":"pulsar-common/src/main/java/org/apache/pulsar/common/util/tls/JcaKeyStores.java","lineNumber":142,"sourceCode":"     * Choose the store type for a process-local in-memory carrier keystore: with no pinned provider the\n     * caller's current default ({@code defaultType}, i.e. today's behaviour), otherwise the first\n     * {@link #IN_MEMORY_STORE_TYPE_PREFERENCE preferred} type the pinned provider actually registers.\n     *\n     * @param jcaProvider the pinned JCA provider, or {@code null}\n     * @param defaultType the type to use when no provider is pinned\n     * @return the carrier store type\n     * @throws KeyStoreException if the pinned provider registers none of the preferred carrier types\n     */\n    public static String inMemoryStoreType(Provider jcaProvider, String defaultType) throws KeyStoreException {\n        if (jcaProvider == null) {\n            return defaultType;\n        }\n        for (String candidate : IN_MEMORY_STORE_TYPE_PREFERENCE) {\n            if (jcaProvider.getService(\"KeyStore\", candidate) != null) {\n                return candidate;\n            }\n        }\n        throw new KeyStoreException(\"jcaProvider='\" + jcaProvider.getName() + \"' supplies none of the in-memory \"\n                + \"carrier keystore types \" + IN_MEMORY_STORE_TYPE_PREFERENCE + \" needed to build the TLS key \"\n                + \"managers. Types this provider registers: \" + registeredTypes(jcaProvider, \"KeyStore\")\n                + \". Unset jcaProvider, or pin a provider that supplies BCFKS or PKCS12.\");\n    }\n\n    /**\n     * Generate a random, per-instance password for a process-local in-memory carrier keystore.\n     *\n     * <p>The carrier's key entries used to be stored under an empty password. PKCS12 (and BCFKS) protect key\n     * entries with a password-based KDF, and a FIPS provider in approved-only mode enforces SP 800-132\n     * constraints on that KDF — a minimum password length among them — so an empty password can be rejected\n     * outright at context-build time. The password is generated, used, and (by the caller) zeroed within a\n     * single build; it is never persisted, logged, or compared.\n     *\n     * @return a freshly generated password\n     */\n    public static char[] newInMemoryPassword() {\n        char[] password = new char[IN_MEMORY_PASSWORD_LENGTH];","sourceCodeStart":124,"sourceCodeEnd":160,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-common/src/main/java/org/apache/pulsar/common/util/tls/JcaKeyStores.java#L124-L160","documentation":"JcaKeyStores.inMemoryStoreType(jcaProvider) selects an in-memory keystore carrier type (BCFKS, then PKCS12, per IN_MEMORY_STORE_TYPE_PREFERENCE) to build TLS key managers. If the pinned provider registers none of the preferred types, it throws KeyStoreException — the key managers cannot be built with that provider.","triggerScenarios":"Calling inMemoryStoreType(provider) or the TLS setup that uses it, when provider.getService(\"KeyStore\", candidate) returns null for every candidate in IN_MEMORY_STORE_TYPE_PREFERENCE (BCFKS, PKCS12).","commonSituations":"FIPS deployments pinning a minimal provider that only registers BCFKS-less subsets; custom or embedded JVMs with stripped security providers.","solutions":["Pin a provider that registers BCFKS or PKCS12 KeyStore services (e.g. BouncyCastle FIPS)","Unset jcaProvider so the JDK default providers are used","Add BouncyCastle (bc-fips) to the classpath and register it before building the TLS context"],"exampleFix":"// before\nSecurity.addProvider(new org.bouncycastle.jce.provider.BouncyJetProvider()); // wrong/none\n// after\nSecurity.addProvider(new org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider());\nString type = JcaKeyStores.inMemoryStoreType(bcFipsProvider); // resolves BCFKS","handlingStrategy":"validation","validationCode":"boolean ok = Stream.of(\"BCFKS\", \"PKCS12\").anyMatch(t -> provider != null && provider.getService(\"KeyStore\", t) != null);\nif (!ok) throw new IllegalArgumentException(\"Provider lacks in-memory keystore types\");","typeGuard":"boolean supportsInMemoryKeyStore(Provider p) { return p != null && (p.getService(\"KeyStore\", \"BCFKS\") != null || p.getService(\"KeyStore\", \"PKCS12\") != null); }","tryCatchPattern":"try { String type = JcaKeyStores.inMemoryStoreType(provider); } catch (KeyStoreException e) { log.error(\"provider {} cannot build TLS key managers: {}\", provider, e.getMessage()); throw e; }","preventionTips":["Use BouncyCastle FIPS provider, which registers BCFKS, for in-memory TLS stores","Unset jcaProvider if you don't need provider pinning","Check provider services at startup with a fail-fast configuration validator","Keep the bc-fips jar on the classpath in all deployment images"],"tags":["java","tls","keystore","fips","configuration"],"backgroundTag":"provider-missing-keystore-type","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}