{"record":{"id":"e035d58ecd1d643c","repo":"SonarSource/sonarqube","slug":"the-property-encryption-secret-key-path-d","errorCode":null,"errorMessage":"\"The property \" + ENCRYPTION_SECRET_KEY_PATH + \" does not link to a valid file: \" + path","messagePattern":"\"The property \" \\+ ENCRYPTION_SECRET_KEY_PATH \\+ \" does not link to a valid file: \" \\+ path","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"critical","filePath":"sonar-plugin-api-impl/src/main/java/org/sonar/api/config/internal/AesCipher.java","lineNumber":74,"sourceCode":"    if (StringUtils.isNotBlank(path)) {\n      File file = new File(path);\n      return file.exists() && file.isFile();\n    }\n    return false;\n  }\n\n  protected Key loadSecretFile() throws IOException {\n    String path = getPathToSecretKey();\n    return loadSecretFileFromFile(path);\n  }\n\n  Key loadSecretFileFromFile(@Nullable String path) throws IOException {\n    if (StringUtils.isBlank(path)) {\n      throw new IllegalStateException(\"Secret key not found. Please set the property \" + ENCRYPTION_SECRET_KEY_PATH);\n    }\n    File file = new File(path);\n    if (!file.exists() || !file.isFile()) {\n      throw new IllegalStateException(\"The property \" + ENCRYPTION_SECRET_KEY_PATH + \" does not link to a valid file: \" + path);\n    }\n    String s = FileUtils.readFileToString(file, UTF_8);\n    if (StringUtils.isBlank(s)) {\n      throw new IllegalStateException(\"No secret key in the file: \" + path);\n    }\n    return new SecretKeySpec(Base64.decodeBase64(StringUtils.trim(s)), CRYPTO_KEY);\n  }\n\n  String generateRandomSecretKey() {\n    try {\n      KeyGenerator keyGen = KeyGenerator.getInstance(CRYPTO_KEY);\n      keyGen.init(KEY_SIZE_IN_BITS, new SecureRandom());\n      SecretKey secretKey = keyGen.generateKey();\n      return Base64.encodeBase64String(secretKey.getEncoded());\n\n    } catch (Exception e) {\n      throw new IllegalStateException(\"Fail to generate secret key\", e);\n    }","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/sonar-plugin-api-impl/src/main/java/org/sonar/api/config/internal/AesCipher.java#L56-L92","documentation":"AesCipher.loadSecretFileFromFile throws this IllegalStateException when the configured path is set but the file at that path does not exist or is not a regular file (e.g. it is a directory). The exception names both the property (ENCRYPTION_SECRET_KEY_PATH, i.e. sonar.secretKeyPath) and the resolved path so the misconfiguration is easy to spot.","triggerScenarios":"sonar.secretKeyPath points to a non-existent file, a directory, a symlink whose target was deleted, or a relative path that does not resolve relative to the SonarQube process working directory.","commonSituations":"Server migration where the secret key file was not copied; wrong absolute path or typo in sonar.properties; running SonarQube as a different user than expected with a different home directory; container images without the mounted secret file.","solutions":["Check the path printed in the exception and create/copy the secret key file to that exact location.","Set sonar.secretKeyPath to an absolute path to avoid working-directory ambiguity.","Ensure the path is a regular file, not a directory, and that any symlink target exists.","In containers, mount the secret key file as a volume and confirm it exists inside the container.","Verify the SonarQube process user has read access to the file's directory and file."],"exampleFix":"// before\nsonar.secretKeyPath=./secret.key\n// after\nsonar.secretKeyPath=/opt/sonarqube/conf/secret.key","handlingStrategy":"validation","validationCode":"File f = new File(secretKeyPath);\nif (!f.isFile()) {\n  throw new IllegalStateException(\"sonar.secretKeyPath must point to an existing regular file: \" + secretKeyPath);\n}","typeGuard":null,"tryCatchPattern":"try {\n  Key key = aesCipher.loadSecretFile();\n} catch (IllegalStateException e) {\n  LOG.error(\"Secret key file problem: \" + e.getMessage());\n}","preventionTips":["Use absolute paths in sonar.secretKeyPath","Verify the file exists and is a regular file after deployment (ls -l)","Mount secret files into containers explicitly and check them at startup","Ensure symlinks resolve and the service user can read the path"],"tags":["encryption","configuration","file-not-found","sonarqube"],"backgroundTag":"file-not-found","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}