karatelabs/karate · error · RuntimeException

failed to create SSL context from files

Error message

failed to create SSL context from files: <message>

What it means

Karate failed to build a Netty SslContext from the supplied PEM certificate and private key files. SslContextBuilder.forServer(certFile, keyFile).build() throws for malformed/unreadable PEM content, mismatched cert/key pairs, or unsupported key formats, and this method wraps that failure in a RuntimeException keeping the original cause.

Solutions

1. Read the wrapped cause — it names the parsing/provider error (e.g. 'no certificate found', 'key mismatch')
2. Verify both files exist, are readable, and are PEM-encoded (BEGIN CERTIFICATE / BEGIN PRIVATE KEY headers)
3. Confirm the certificate and key belong to the same pair (compare public key / modulus)
4. Decrypt password-protected keys or strip the passphrase (openssl rsa -in key.pem -out key-nopass.pem)
5. Convert other formats to PEM (openssl x509 / openssl pkcs8) and retry

Example fix

// before: PKCS#12 file passed as PEM
SslUtils.createNettySslContext(new File("server.p12"), new File("server.key"));
// after: convert to PEM first, then pass PEM files
// openssl pkcs12 -in server.p12 -clcerts -nokeys -out server.crt
// openssl pkcs12 -in server.p12 -nocerts -nodes -out server.key
SslUtils.createNettySslContext(new File("server.crt"), new File("server.key"));

// verify PEM inputs before building the SSL context
static boolean validPemPair(File cert, File key) {
    try {
        String c = java.nio.file.Files.readString(cert.toPath());
        String k = java.nio.file.Files.readString(key.toPath());
        return c.contains("BEGIN CERTIFICATE") && (k.contains("BEGIN PRIVATE KEY") || k.contains("BEGIN RSA PRIVATE KEY") || k.contains("BEGIN EC PRIVATE KEY"));
    } catch (Exception e) { return false; }
}

try { SslContext ctx = SslUtils.createNettySslContext(certFile, keyFile); } catch (RuntimeException e) { throw new IllegalStateException("check PEM cert/key files: " + e.getCause().getMessage(), e); }

When it happens

Trigger: Calling SslUtils.createNettySslContext(File certFile, File keyFile) — or configuring a mock server with cert/key files — when the PEM files are missing, unreadable, encrypted (password-protected), not valid PEM, or the certificate does not match the private key.

Common situations: Passing a PKCS#12 (.p12) file where PEM is expected; certificate and key from different pairs; key encrypted with a passphrase Karate does not supply; file path typos in test config; Java unable to find an SSL provider on minimal JREs.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed to generate Netty SSL context
• failed to create server SSL context
• failed to load private key: unsupported algorithm
• CONNECT_FAILED
• failed to create client SSL context

AI-assisted analysis of karatelabs/karate@a22eb90246 (2026-09-12). Data as JSON: /api/errors/6781ea6d370bd9ca. Report an issue: GitHub.

Appendix: source

Thrown at karate-core/src/main/java/io/karatelabs/core/SslUtils.java:113

            java.util.Date notAfter = new java.util.Date(notBefore.getTime() + (86400000L * VALIDITY_DAYS));

            @SuppressWarnings("deprecation")
            SelfSignedCertificate ssc = new SelfSignedCertificate("localhost", notBefore, notAfter);

            return SslContextBuilder.forServer(ssc.certificate(), ssc.privateKey()).build();
        } catch (Exception e) {
            throw new RuntimeException("failed to generate Netty SSL context: " + e.getMessage(), e);
        }
    }

    /**
     * Create a Netty SslContext from PEM files.
     */
    public static SslContext createNettySslContext(File certFile, File keyFile) {
        try {
            return SslContextBuilder.forServer(certFile, keyFile).build();
        } catch (Exception e) {
            throw new RuntimeException("failed to create SSL context from files: " + e.getMessage(), e);
        }
    }

    /**
     * Create a Netty SslContext from PEM file paths.
     */
    public static SslContext createNettySslContext(String certPath, String keyPath) {
        return createNettySslContext(new File(certPath), new File(keyPath));
    }

    /**
     * Load private key from a PEM file.
     */
    private static java.security.PrivateKey loadPrivateKeyFromFile(File keyFile) throws Exception {
        byte[] keyBytes = java.nio.file.Files.readAllBytes(keyFile.toPath());
        String keyString = new String(keyBytes, java.nio.charset.StandardCharsets.UTF_8);

        // Remove PEM headers/footers and decode

View on GitHub (pinned to a22eb90246)