{"record":{"id":"a6b3513f64bdaf6c","repo":"apache/shenyu","slug":"could-not-load-certificatefactory-x-509","errorCode":null,"errorMessage":"Could not load CertificateFactory X.509","messagePattern":"Could not load CertificateFactory X\\.509","errorType":"exception","errorClass":"ShenyuException","httpStatus":null,"severity":"error","filePath":"shenyu-plugin/shenyu-plugin-httpclient/src/main/java/org/apache/shenyu/plugin/httpclient/config/HttpClientProperties.java","lineNumber":1107,"sourceCode":"        public X509Certificate[] getTrustedX509CertificatesForTrustManager() {\n            try {\n                CertificateFactory certificateFactory = CertificateFactory\n                        .getInstance(\"X.509\");\n                List<Certificate> allCerts = new ArrayList<>();\n                for (String trustedCert : ssl.getTrustedX509Certificates()) {\n                    try {\n                        URL url = ResourceUtils.getURL(trustedCert);\n                        Collection<? extends Certificate> certs = certificateFactory\n                                .generateCertificates(url.openStream());\n                        allCerts.addAll(certs);\n                    } catch (IOException e) {\n                        throw new ShenyuException(\n                                \"Could not load certificate '\" + trustedCert + \"'\", e);\n                    }\n                }\n                return allCerts.toArray(new X509Certificate[allCerts.size()]);\n            } catch (CertificateException e) {\n                throw new ShenyuException(\"Could not load CertificateFactory X.509\", e);\n            }\n        }\n    \n        /**\n         * Gets key manager factory.\n         *\n         * @return the key manager factory\n         */\n        public KeyManagerFactory getKeyManagerFactory() {\n            try {\n                if (StringUtils.isNotEmpty(getKeyStorePath())) {\n                    KeyManagerFactory keyManagerFactory = KeyManagerFactory\n                            .getInstance(KeyManagerFactory.getDefaultAlgorithm());\n                    char[] keyPassword = Optional.ofNullable(getKeyPassword())\n                            .map(String::toCharArray).orElse(getKeyStorePassword().toCharArray());\n                    keyManagerFactory.init(this.createKeyStore(), keyPassword);\n                    return keyManagerFactory;\n                }","sourceCodeStart":1089,"sourceCodeEnd":1125,"githubUrl":"https://github.com/apache/shenyu/blob/567142e07261b3e615ae8850b30f4421f455cc5d/shenyu-plugin/shenyu-plugin-httpclient/src/main/java/org/apache/shenyu/plugin/httpclient/config/HttpClientProperties.java#L1089-L1125","documentation":"In the same trust-material setup, CertificateFactory.getInstance(\"X.509\") (or equivalent) throwing CertificateException means the JVM could not provide an X.509 certificate factory. The code rethrows it as ShenyuException 'Could not load CertificateFactory X.509'.","triggerScenarios":"CertificateFactory X.509 instantiation fails while initializing the HTTP client's trust manager — effectively only when the JDK's security providers are broken, a custom provider list removes the standard X.509 factory, or the JVM's security config (java.security) is tampered with.","commonSituations":"Custom JRE builds with stripped security providers, overridden java.security file in the container, misconfigured security.provider entries, unusual JDK distributions.","solutions":["Restore the default security providers: check the JVM's java.security file for modified security.provider entries.","Run with a standard JDK/JRE distribution (e.g. Temurin 17) instead of a stripped custom image.","Inspect the wrapped CertificateException for provider-specific details.","As a workaround, register a provider that supplies the X.509 CertificateFactory."],"exampleFix":"// before (java.security)\n# security.provider.1=sun.security.provider.SunSecurityProvider  (commented out)\n// after\nsecurity.provider.1=sun.security.provider.Sun\nsecurity.provider.2=org.bouncycastle.jce.provider.BouncyCastle","handlingStrategy":"try-catch","validationCode":"try {\n  java.security.cert.CertificateFactory.getInstance(\"X.509\");\n} catch (java.security.cert.CertificateException e) {\n  throw new IllegalStateException(\"JVM lacks X.509 CertificateFactory provider\", e);\n}","typeGuard":null,"tryCatchPattern":"try {\n  initTlsContext();\n} catch (ShenyuException e) {\n  if (e.getMessage().contains(\"CertificateFactory\")) {\n    log.error(\"JDK security providers broken — restore default java.security\", e);\n  }\n  throw e;\n}","preventionTips":["Use standard JDK distributions; avoid stripped/minimal JREs for the gateway.","Don't remove default security.provider entries from java.security.","Smoke-test TLS initialization in CI with the same JVM image used in production."],"tags":["tls","jvm","certificate"],"backgroundTag":"module-init-failed","analyzedSha":"567142e07261b3e615ae8850b30f4421f455cc5d","analyzedAt":"2026-09-12T10:08:21.293Z","contentChangedAt":"2026-09-12T10:08:21.293Z","schemaVersion":2},"datasetVersion":"2026-09-19T12:17:13.211Z"}