{"record":{"id":"c8a6f4990723c020","repo":"apache/pulsar","slug":"jcaprovider-providername-does-not-supply-keys","errorCode":null,"errorMessage":"jcaProvider='${providerName}' does not supply KeyStore type '${type}'. Types this provider registers: ${registeredTypes}. Set the store type to one of these (BCFKS is the FIPS-approved format), or unset jcaProvider.","messagePattern":"jcaProvider='(.+?)' does not supply KeyStore type '(.+?)'\\. Types this provider registers: (.+?)\\. Set the store type to one of these \\(BCFKS is the FIPS-approved format\\), or unset jcaProvider\\.","errorType":"exception","errorClass":"KeyStoreException","httpStatus":null,"severity":"error","filePath":"pulsar-common/src/main/java/org/apache/pulsar/common/util/tls/JcaKeyStores.java","lineNumber":92,"sourceCode":"\n    private JcaKeyStores() {\n    }\n\n    /**\n     * Create a {@link KeyStore} of the given type, from {@code jcaProvider} when one is pinned.\n     *\n     * @param type        the store type (e.g. {@code PKCS12}, {@code BCFKS}, {@code JKS})\n     * @param jcaProvider the pinned JCA provider, or {@code null} for the JVM provider search order\n     * @return an (unloaded) {@link KeyStore} instance\n     * @throws KeyStoreException if the type is unavailable — including when a pinned provider does not\n     *                           register it (fail loud, with the provider's registered types in the message)\n     */\n    public static KeyStore keyStore(String type, Provider jcaProvider) throws KeyStoreException {\n        if (jcaProvider == null) {\n            return KeyStore.getInstance(type);\n        }\n        if (jcaProvider.getService(\"KeyStore\", type) == null) {\n            throw new KeyStoreException(\"jcaProvider='\" + jcaProvider.getName() + \"' does not supply KeyStore type '\"\n                    + type + \"'. Types this provider registers: \" + registeredTypes(jcaProvider, \"KeyStore\")\n                    + \". Set the store type to one of these (BCFKS is the FIPS-approved format), or unset \"\n                    + \"jcaProvider.\");\n        }\n        return KeyStore.getInstance(type, jcaProvider);\n    }\n\n    /**\n     * Create an X.509 {@link CertificateFactory}, from {@code jcaProvider} when one is pinned.\n     *\n     * @param type        the certificate type (in practice {@code X.509})\n     * @param jcaProvider the pinned JCA provider, or {@code null} for the JVM provider search order\n     * @return the certificate factory\n     * @throws CertificateException if the type is unavailable — including when a pinned provider does not\n     *                              register it\n     */\n    public static CertificateFactory certificateFactory(String type, Provider jcaProvider)\n            throws CertificateException {","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-common/src/main/java/org/apache/pulsar/common/util/tls/JcaKeyStores.java#L74-L110","documentation":"JcaKeyStores.keyStore(type, jcaProvider) pins KeyStore creation to a specific java.security.Provider. Before delegating it verifies via Provider.getService(\"KeyStore\", type) that the provider actually registers that store type; if not, it throws KeyStoreException listing the types the provider does support (BCFKS being the FIPS-approved choice).","triggerScenarios":"Calling keyStore(\"JKS\"|\"PKCS12\"|\"BCFKS\"|..., bouncyCastleFipsProvider) where the pinned provider lacks that KeyStore service — e.g. requesting JKS from BouncyCastle FIPS, which only registers BCFKS/BCPKCS12-style types.","commonSituations":"FIPS-mode TLS configuration where tlsRequireValidHostname/store type settings mix JDK default store types with the BC FIPS provider; upgrading to FIPS while keeping legacy keystore files.","solutions":["Change the configured keystore type to one the provider registers (prefer BCFKS when using BCFIPS)","Convert the keystore file to that type (keytool -importkeystore -srcstoretype JKS -deststoretype BCFKS)","Set jcaProvider to null/omit it so KeyStore.getInstance(type) uses the default provider search","Pin a different provider that does register the requested type"],"exampleFix":"// before\nKeyStore ks = JcaKeyStores.keyStore(\"JKS\", bcFipsProvider);\n// after\nKeyStore ks = JcaKeyStores.keyStore(\"BCFKS\", bcFipsProvider);","handlingStrategy":"validation","validationCode":"Provider p = ...; String type = \"BCFKS\";\nif (p != null && p.getService(\"KeyStore\", type) == null) {\n    throw new IllegalArgumentException(\"Provider \" + p.getName() + \" lacks KeyStore type \" + type);\n}","typeGuard":"boolean providerHasKeyStoreType(Provider p, String type) { return p == null || p.getService(\"KeyStore\", type) != null; }","tryCatchPattern":"try { return JcaKeyStores.keyStore(type, provider); } catch (KeyStoreException e) { log.error(\"keystore type {} unavailable in provider {}; message: {}\", type, provider, e.getMessage()); throw e; }","preventionTips":["Match the store type to the pinned provider (BCFKS for BCFIPS)","Convert legacy JKS/PKCS12 files to BCFKS when enabling FIPS mode","Log or inspect registered types: provider.getServices() / provider.stringPropertyNames()","Test TLS keystore loading in a FIPS-enabled profile before deployment"],"tags":["java","tls","keystore","fips","configuration"],"backgroundTag":"provider-missing-keystore-type","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}