{"record":{"id":"dc81c92fcaec84a8","repo":"quarkusio/quarkus","slug":"unable-to-decrypt-the-key-file-config-key","errorCode":null,"errorMessage":"Unable to decrypt the key file: + config.key()","messagePattern":"Unable to decrypt the key file: \\+ config\\.key\\(\\)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemKeyCertConfig.java","lineNumber":72,"sourceCode":"                if (keyCert == null) {\n                    throw new IllegalArgumentException(\"The key/cert pair with the name '\" + name\n                            + \"' is not found in the `order` list: \" + order().get());\n                }\n                orderedListOfPair.add(keyCert);\n            }\n        } else {\n            // Use the lexical order.\n            orderedListOfPair.addAll(new TreeMap<>(keyCerts()).values());\n        }\n\n        for (KeyCertConfig config : orderedListOfPair) {\n            options.addCertValue(Buffer.buffer(read(config.cert())));\n            if (config.password().isPresent()) {\n                byte[] content = read(config.key());\n                String contentAsString = new String(content, StandardCharsets.UTF_8);\n                Buffer decrypted = new EncryptedPKCS8Parser().decryptKey(contentAsString, config.password().get());\n                if (decrypted == null) {\n                    throw new IllegalArgumentException(\"Unable to decrypt the key file: \" + config.key());\n                }\n                options.addKeyValue(decrypted);\n            } else {\n                options.addKeyValue(Buffer.buffer(read(config.key())));\n            }\n        }\n        return options;\n    }\n\n    interface KeyCertConfig {\n\n        /**\n         * The path to the key file (in PEM format: PKCS#8, PKCS#1 or encrypted PKCS#8).\n         */\n        Path key();\n\n        /**\n         * The path to the certificate file (in PEM format).","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemKeyCertConfig.java#L54-L90","documentation":"The TLS registry reads the configured private key file and, when a password is present, assumes it is an encrypted PKCS#8 key. The EncryptedPKCS8Parser returns null when the key material cannot be decrypted (wrong password or not an encrypted PKCS#8 structure), and PemKeyCertConfig.toOptions then throws this IllegalArgumentException instead of loading an unusable key.","triggerScenarios":"Configuring quarkus.tls.key-store.pem.key.* with a key file that is not an encrypted PKCS#8 key while quarkus.tls.key-store.pem.password (or password-key-file) is set; the parser fails to decrypt and returns null.","commonSituations":"Password set but the key is an unencrypted PEM; key is PKCS#1 ('RSA PRIVATE KEY') or unencrypted PKCS#8 rather than encrypted PKCS#8 ('ENCRYPTED PRIVATE KEY'); wrong password after a credential rotation; password fetched from a CredentialsProvider returning the wrong secret.","solutions":["Convert the key to an encrypted PKCS#8 container: openssl pkcs8 -topk8 -v2 aes-256-cbc -in key.pem -out key.pkcs8.pem","Remove the password config if the key is actually unencrypted","Verify the password is correct (test decryption with openssl pkey -in key.pkcs8.pem -passin pass:...)","Check the CredentialsProvider value if the password comes from config credential-provider references"],"exampleFix":"# before\nquarkus.tls.my-tls.key-store.pem.0.key=key.pem\nquarkus.tls.my-tls.key-store.pem.password=secret\n# after (key converted to encrypted PKCS#8)\n# openssl pkcs8 -topk8 -in key.pem -out key.pkcs8.pem\nquarkus.tls.my-tls.key-store.pem.0.key=key.pkcs8.pem\nquarkus.tls.my-tls.key-store.pem.password=secret","handlingStrategy":"validation","validationCode":"// Pre-check key format before referencing it in TLS config\nString content = Files.readString(Path.of(\"key.pem\"));\nif (content.contains(\"ENCRYPTED PRIVATE KEY\")) {\n    // encrypted PKCS#8: ensure configured password decrypts it\n} else {\n    throw new IllegalStateException(\n        \"Key must be encrypted PKCS#8 when a password is set; re-encrypt: openssl pkcs8 -topk8 -in key.pem -out key.pkcs8.pem\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only set pem.password when the key is an encrypted PKCS#8 PEM","Convert keys with openssl pkcs8 -topk8 -v2 aes-256-cbc","Rotate keys/passwords together and test decryption in CI"],"tags":["tls","keystore","pem","decryption"],"backgroundTag":"tls-key-decryption-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}