{"record":{"id":"ab64e95ca32a6afe","repo":"quarkusio/quarkus","slug":"key-can-not-be-loaded","errorCode":null,"errorMessage":"Key can not be loaded","messagePattern":"Key can not be loaded","errorType":"exception","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java","lineNumber":539,"sourceCode":"                    var keyStoreFile = creds.jwt().keyStoreFile().get();\n                    KeyStore ks = KeyStore.getInstance(inferKeyStoreTypeFromFileExtension(keyStoreFile));\n                    InputStream is = ResourceUtils.getResourceStream(keyStoreFile);\n\n                    if (creds.jwt().keyStorePassword().isPresent()) {\n                        ks.load(is, creds.jwt().keyStorePassword().get().toCharArray());\n                    } else {\n                        ks.load(is, null);\n                    }\n\n                    if (creds.jwt().keyPassword().isPresent()) {\n                        key = ks.getKey(creds.jwt().keyId().get(), creds.jwt().keyPassword().get().toCharArray());\n                    } else {\n                        throw new ConfigurationException(\n                                \"When using a key store, the `quarkus.oidc-client.credentials.jwt.key-password` property must be set\");\n                    }\n                }\n            } catch (Exception ex) {\n                throw new ConfigurationException(\"Key can not be loaded\", ex);\n            }\n            if (key == null) {\n                throw new ConfigurationException(\"Key is null\");\n            }\n            return Uni.createFrom().item(key);\n        }\n    }\n\n    public static String signJwtWithKey(OidcClientCommonConfig oidcConfig, String tokenRequestUri, Key key) {\n        // 'jti' and 'iat' claims are created by default, 'iat' - is set to the current time\n        JwtSignatureBuilder jwtSignatureBuilder = Jwt\n                .claims(additionalClaims(oidcConfig.credentials().jwt().claims()))\n                .issuer(oidcConfig.credentials().jwt().issuer().orElse(oidcConfig.clientId().get()))\n                .subject(oidcConfig.credentials().jwt().subject().orElse(oidcConfig.clientId().get()))\n                .audience(oidcConfig.credentials().jwt().audience().isPresent()\n                        ? removeAudienceTrailingSlash(oidcConfig.credentials().jwt(),\n                                oidcConfig.credentials().jwt().audience().get())\n                        : tokenRequestUri)","sourceCodeStart":521,"sourceCodeEnd":557,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java#L521-L557","documentation":"Loading the JWT signing key from a key store or PEM file failed with an underlying exception (file not found, bad password, corrupt store, unsupported format). Quarkus wraps the cause in a ConfigurationException with the message 'Key can not be loaded'.","triggerScenarios":"clientJwtKey (invoked via initClientJwtKey) throws while reading credentials.jwt.key / key-file / key-store-file: wrong key-store password, unreadable or missing file, invalid PEM/DER content, unsupported key algorithm, orks.getKey failure.","commonSituations":"Typo in key-file path or classpath resource; key store created with a different password than configured; PEM key in an unsupported format (e.g. encrypted PKCS#8); file missing in container image after packaging.","solutions":["Inspect the wrapped cause (ex.getCause()) to identify whether it is IO (file missing/unreadable) or crypto (wrong password/format)","Verify the key store/file path is on the classpath or an absolute filesystem path that exists in the runtime image","Confirm key-store-password and key-password match how the store was created","Regenerate or re-export the key in a supported format (unencrypted PKCS#8 PEM or JKS/PKCS12 key store)","Test loading the key standalone with keytool/openssl to validate the file"],"exampleFix":"// before\nquarkus.oidc-client.credentials.jwt.key-file=/app/keys/encrypted-key.pem  // file missing in container\n// after\nquarkus.oidc-client.credentials.jwt.key-file=classpath:signing-key.pem    // packaged resource, verified","handlingStrategy":"try-catch","validationCode":"try (InputStream is = getClass().getResourceAsStream(keyPath)) {\n    if (is == null) throw new IllegalStateException(\"Key file not found: \" + keyPath);\n}","typeGuard":null,"tryCatchPattern":"try { startApp(); } catch (ConfigurationException e) {\n    if (\"Key can not be loaded\".equals(e.getMessage())) {\n        log.errorf(e.getCause(), \"Check key file existence, path, and passwords\");\n    }\n    throw e;\n}","preventionTips":["Validate key files with keytool/openssl before deploying","Use classpath: resources to guarantee packaging into the artifact","Confirm container images include the key files at the configured paths","Log the underlying cause, not just the wrapper message"],"tags":["oidc","keystore","crypto","file-io"],"backgroundTag":"key-load-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}