karatelabs/karate · error · RuntimeException

failed to generate self-signed certificate

Error message

failed to generate self-signed certificate: <message>

What it means

SslUtils.generateSelfSigned builds a key pair, self-signed X.509 certificate, and an SSLContext for localhost. Any exception in that pipeline (keygen, signing, context init) is wrapped as "failed to generate self-signed certificate: <message>".

Solutions

1. Inspect the chained cause; confirm the JVM supports key generation and 'TLS' SSLContext (run a minimal SSLContext.getInstance("TLS") smoke test)
2. Check java.security providers config; ensure standard providers (SUN, SunJSSE) are enabled
3. Provide your own cert/key via the SSL config certPath/keyPath to bypass self-signed generation

Example fix

// before: relies on self-signed generation in a restricted JVM
* configure ssl = { port: 8443 }
// after: supply your own material
* configure ssl = { port: 8443, certPath: 'certs/server.crt', keyPath: 'certs/server.key' }

// smoke-test JVM crypto before enabling self-signed HTTPS
SSLContext.getInstance("TLS").init(null, null, new SecureRandom());

try { ctx = SslUtils.generateSelfSigned(); } catch (RuntimeException e) { throw new IllegalStateException("self-signed generation failed, check JVM security providers: " + e.getCause(), e); }

When it happens

Trigger: Starting an HTTPS Karate server without certPath, triggering self-signed generation; failure due to missing crypto providers, invalid default algorithm in the JVM, or internal key manager errors.

Common situations: Restricted/fips-only JVMs lacking needed algorithms; exotic JDK distributions without default X.509 facilities; security provider misconfiguration via java.security file.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed to create server SSL context
• failed to create client SSL context
• failed to generate Netty SSL context
• CONNECT_FAILED
• could not build the pooled client's SSL context

AI-assisted analysis of karatelabs/karate@a22eb90246 (2026-09-12). Data as JSON: /api/errors/42e144e51a041fbd. Report an issue: GitHub.

Appendix: source

Thrown at karate-core/src/main/java/io/karatelabs/core/SslUtils.java:85

            try (java.io.FileInputStream fis = new java.io.FileInputStream(ssc.certificate())) {
                cert = cf.generateCertificate(fis);
            }

            // Load private key
            java.security.PrivateKey privateKey = loadPrivateKeyFromFile(ssc.privateKey());

            keyStore.setKeyEntry("server", privateKey, new char[0], new Certificate[]{cert});

            KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
            kmf.init(keyStore, new char[0]);

            SSLContext ctx = SSLContext.getInstance("TLS");
            ctx.init(kmf.getKeyManagers(), null, new java.security.SecureRandom());

            logger.info("generated self-signed certificate for localhost (valid {} days)", VALIDITY_DAYS);
            return ctx;
        } catch (Exception e) {
            throw new RuntimeException("failed to generate self-signed certificate: " + e.getMessage(), e);
        }
    }

    /**
     * Generate a Netty SslContext for server use.
     */
    public static SslContext generateNettySslContext() {
        try {
            java.util.Date notBefore = new java.util.Date();
            java.util.Date notAfter = new java.util.Date(notBefore.getTime() + (86400000L * VALIDITY_DAYS));

            @SuppressWarnings("deprecation")
            SelfSignedCertificate ssc = new SelfSignedCertificate("localhost", notBefore, notAfter);

            return SslContextBuilder.forServer(ssc.certificate(), ssc.privateKey()).build();
        } catch (Exception e) {
            throw new RuntimeException("failed to generate Netty SSL context: " + e.getMessage(), e);
        }

View on GitHub (pinned to a22eb90246)