{"record":{"id":"b8e9cf2ad9de93b3","repo":"apache/cassandra","slug":"unable-to-load-key-from-keystore","errorCode":null,"errorMessage":"unable to load key from keystore","messagePattern":"unable to load key from keystore","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/JKSKeyProvider.java","lineNumber":81,"sourceCode":"    }\n\n    public Key getSecretKey(String keyAlias) throws IOException\n    {\n        // there's a lovely behavior with jceks files that all aliases are lower-cased\n        if (isJceks)\n            keyAlias = toLowerCaseLocalized(keyAlias);\n\n        Key key;\n        try\n        {\n            String password = options.get(PROP_KEY_PW);\n            if (password == null || password.isEmpty())\n                password = options.get(PROP_KEYSTORE_PW);\n            key = store.getKey(keyAlias, password.toCharArray());\n        }\n        catch (Exception e)\n        {\n            throw new IOException(\"unable to load key from keystore\");\n        }\n        if (key == null)\n            throw new IOException(String.format(\"key %s was not found in keystore\", keyAlias));\n        return key;\n    }\n}\n","sourceCodeStart":63,"sourceCodeEnd":88,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/JKSKeyProvider.java#L63-L88","documentation":"In JKSKeyProvider.getSecretKey, store.getKey threw (wrong password for the key, or a keystore-level error), and the catch block rethrows as IOException('unable to load key from keystore'). The TDE secret for the requested alias cannot be retrieved, so encrypt/decrypt operations fail.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/security/JKSKeyProvider.java:81 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set the correct key_password (or ensure it falls back to keystore_password) in the encryption options","Re-add the key to the keystore under the expected alias"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}