{"record":{"id":"ac060f5ba7659072","repo":"apache/shenyu","slug":"could-not-load-keystore-for-type-and-provider","errorCode":null,"errorMessage":"Could not load KeyStore for type and provider","messagePattern":"Could not load KeyStore for type and provider","errorType":"exception","errorClass":"ShenyuException","httpStatus":null,"severity":"error","filePath":"shenyu-plugin/shenyu-plugin-httpclient/src/main/java/org/apache/shenyu/plugin/httpclient/config/HttpClientProperties.java","lineNumber":1156,"sourceCode":"            String provider = getKeyStoreProvider();\n            String storeType = getKeyStoreType();\n            String keyStorePath = getKeyStorePath();\n            String keyStorePassword = getKeyStorePassword();\n            try {\n                KeyStore keyStore = StringUtils.isNotEmpty(provider)\n                        ? KeyStore.getInstance(storeType, provider)\n                        : KeyStore.getInstance(storeType);\n                try {\n                    char[] keyPassword = Optional.ofNullable(keyStorePassword)\n                            .map(String::toCharArray).orElse(null);\n                    URL url = ResourceUtils.getURL(keyStorePath);\n                    keyStore.load(url.openStream(), keyPassword);\n                } catch (Exception e) {\n                    throw new ShenyuException(\"Could not load key store path ' \" + keyStorePath + \"'\", e);\n                }\n                return keyStore;\n            } catch (KeyStoreException | NoSuchProviderException e) {\n                throw new ShenyuException(\"Could not load KeyStore for type and provider\", e);\n            }\n        }\n    }\n}\n","sourceCodeStart":1138,"sourceCodeEnd":1161,"githubUrl":"https://github.com/apache/shenyu/blob/567142e07261b3e615ae8850b30f4421f455cc5d/shenyu-plugin/shenyu-plugin-httpclient/src/main/java/org/apache/shenyu/plugin/httpclient/config/HttpClientProperties.java#L1138-L1161","documentation":"HttpClientProperties loads a keystore from a configured path to set up mutual TLS for the HTTP client. After the KeyStore.getInstance(type, provider) call succeeds, a KeyStoreException or NoSuchProviderException means the JRE cannot supply a KeyStore implementation for the requested type/provider combination. The library wraps it in a ShenyuException so that the client bean creation fails fast instead of producing a half-configured SSL context.","triggerScenarios":"Calling the keystore-building code in HttpClientProperties with keyStoreType set to a type the JVM has no provider for, or keyStoreProvider set to a provider class not present in the JDK/security providers list.","commonSituations":"Typo in the keystore type (e.g. 'PKS12' instead of 'PKCS12'); specifying a custom security provider that isn't registered via java.security or the provider jar missing from the classpath; running on a minimal JRE (jlink image) that excludes some keystore implementations.","solutions":["Fix the keyStoreType value to a standard type: JKS or PKCS12 (PKCS12 is the default since Java 9).","If keyStoreProvider is set, remove it or ensure the named provider is on the classpath and registered (Security.addProvider or java.security file).","Run a quick check: KeyStore.getInstance(type) in isolation to see which types your JVM supports.","If using a trimmed JRE, switch to a full JDK image or add the missing crypto module."],"exampleFix":"// before\nshenyu.httpclient.keyStoreType=PKS12\n// after\nshenyu.httpclient.keyStoreType=PKCS12","handlingStrategy":"validation","validationCode":"String type = props.getKeyStoreType();\ntry {\n    java.security.KeyStore.getInstance(type == null ? \"PKCS12\" : type);\n} catch (Exception e) {\n    throw new IllegalStateException(\"Unsupported keystore type: \" + type, e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    // start client that uses the keystore\n} catch (ShenyuException e) {\n    if (e.getMessage().contains(\"KeyStore for type and provider\")) {\n        // fall back to default JVM keystore config or abort startup with clear message\n    }\n}","preventionTips":["Stick to standard keystore types JKS or PKCS12 unless a custom provider is genuinely required.","Only set keyStoreProvider when the provider jar is definitely on the classpath and registered.","Smoke-test TLS config in CI with the same JRE image used in production.","Avoid trimmed/jlink JRE images that omit keystore implementations."],"tags":["ssl","keystore","configuration","java"],"backgroundTag":"invalid-config-value","analyzedSha":"567142e07261b3e615ae8850b30f4421f455cc5d","analyzedAt":"2026-09-12T10:08:21.293Z","contentChangedAt":"2026-09-12T10:08:21.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}