{"record":{"id":"b345339d7f873186","repo":"karatelabs/karate","slug":"failed-to-create-server-ssl-context-message","errorCode":null,"errorMessage":"failed to create server SSL context: <message>","messagePattern":"failed to create server SSL context: <message>","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"karate-core/src/main/java/io/karatelabs/core/SslContextFactory.java","lineNumber":80,"sourceCode":"            ctx.init(keyManagers, trustManagers, new SecureRandom());\n            return ctx;\n        } catch (Exception e) {\n            throw new RuntimeException(\"failed to create client SSL context: \" + e.getMessage(), e);\n        }\n    }\n\n    /**\n     * Create an SSLContext for server use (accepting HTTPS connections).\n     */\n    public static SSLContext createServerContext(SslConfig config) {\n        try {\n            if (config.getCertPath() == null) {\n                // Generate self-signed certificate\n                return SslUtils.generateSelfSigned();\n            }\n            return loadFromPem(config.getCertPath(), config.getKeyPath(), config.getAlgorithm());\n        } catch (Exception e) {\n            throw new RuntimeException(\"failed to create server SSL context: \" + e.getMessage(), e);\n        }\n    }\n\n    /**\n     * Create a trust-all SSLContext (accepts any certificate).\n     */\n    private static SSLContext createTrustAllContext(String algorithm) throws Exception {\n        TrustManager[] trustManagers = new TrustManager[]{\n            new X509TrustManager() {\n                @Override\n                public void checkClientTrusted(X509Certificate[] chain, String authType) {\n                }\n\n                @Override\n                public void checkServerTrusted(X509Certificate[] chain, String authType) {\n                }\n\n                @Override","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/karatelabs/karate/blob/a22eb90246d958d15a47bf436693d0121ad2812d/karate-core/src/main/java/io/karatelabs/core/SslContextFactory.java#L62-L98","documentation":"SslContextFactory.createServerContext creates an SSLContext for a Karate mock/HTTPS server. If a certPath is provided it loads from PEM; otherwise it generates a self-signed cert. Any exception in either path is wrapped as \"failed to create server SSL context: <message>\".","triggerScenarios":"Starting an HTTPS mock server (karate.start with ssl: true) where the PEM cert/key files are missing, unreadable, or malformed, or the self-signed generation fails (e.g. missing crypto provider).","commonSituations":"Typo in certPath/keyPath; PEM files with wrong permissions in containers; encrypted PEM keys with unsupported passphrase handling; JRE lacking the classes needed for self-signed generation.","solutions":["Check the chained cause message; verify certPath/keyPath point to valid, readable PEM files and match each other","If you don't need custom certs, remove certPath so Karate generates a self-signed certificate","Test key/cert loading with openssl (e.g. `openssl x509 -in cert.pem`, `openssl pkey -in key.pem`) to confirm validity"],"exampleFix":"// before\n* configure ssl = { certPath: 'certs/server.pem', keyPath: 'certs/wrong.key' }\n// after\n* configure ssl = { certPath: 'certs/server.crt', keyPath: 'certs/server.key' }","handlingStrategy":"validation","validationCode":"if (config.getCertPath() != null) {\n    if (!java.nio.file.Files.isReadable(java.nio.file.Path.of(config.getCertPath())))\n        throw new IllegalStateException(\"cert not readable: \" + config.getCertPath());\n    if (!java.nio.file.Files.isReadable(java.nio.file.Path.of(config.getKeyPath())))\n        throw new IllegalStateException(\"key not readable: \" + config.getKeyPath());\n}","typeGuard":null,"tryCatchPattern":"try { server = karate.start(mock, sslConfig); } catch (RuntimeException e) { if (e.getMessage().startsWith(\"failed to create server SSL context\")) { /* validate PEM files with openssl */ } throw e; }","preventionTips":["Validate cert and key PEM files with openssl before use","Ensure cert and key belong to the same pair","Use Karate's self-signed generation unless you specifically need custom certs"],"tags":["ssl","tls","server","pem"],"backgroundTag":"file-not-found","analyzedSha":"a22eb90246d958d15a47bf436693d0121ad2812d","analyzedAt":"2026-09-12T09:01:00.220Z","contentChangedAt":"2026-09-12T09:01:00.220Z","schemaVersion":2},"datasetVersion":"2026-09-16T19:17:19.609Z"}