What causes "Key can not be loaded" in quarkusio/quarkus?

Inspect the wrapped cause (ex.getCause()) to identify whether it is IO (file missing/unreadable) or crypto (wrong password/format)

quarkusio/quarkus · error · ConfigurationException

Key can not be loaded

Error message

Key can not be loaded

What it means

Loading the JWT signing key from a key store or PEM file failed with an underlying exception (file not found, bad password, corrupt store, unsupported format). Quarkus wraps the cause in a ConfigurationException with the message 'Key can not be loaded'.

Source

Thrown at extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java:539

                    var keyStoreFile = creds.jwt().keyStoreFile().get();
                    KeyStore ks = KeyStore.getInstance(inferKeyStoreTypeFromFileExtension(keyStoreFile));
                    InputStream is = ResourceUtils.getResourceStream(keyStoreFile);

                    if (creds.jwt().keyStorePassword().isPresent()) {
                        ks.load(is, creds.jwt().keyStorePassword().get().toCharArray());
                    } else {
                        ks.load(is, null);
                    }

                    if (creds.jwt().keyPassword().isPresent()) {
                        key = ks.getKey(creds.jwt().keyId().get(), creds.jwt().keyPassword().get().toCharArray());
                    } else {
                        throw new ConfigurationException(
                                "When using a key store, the `quarkus.oidc-client.credentials.jwt.key-password` property must be set");
                    }
                }
            } catch (Exception ex) {
                throw new ConfigurationException("Key can not be loaded", ex);
            }
            if (key == null) {
                throw new ConfigurationException("Key is null");
            }
            return Uni.createFrom().item(key);
        }
    }

    public static String signJwtWithKey(OidcClientCommonConfig oidcConfig, String tokenRequestUri, Key key) {
        // 'jti' and 'iat' claims are created by default, 'iat' - is set to the current time
        JwtSignatureBuilder jwtSignatureBuilder = Jwt
                .claims(additionalClaims(oidcConfig.credentials().jwt().claims()))
                .issuer(oidcConfig.credentials().jwt().issuer().orElse(oidcConfig.clientId().get()))
                .subject(oidcConfig.credentials().jwt().subject().orElse(oidcConfig.clientId().get()))
                .audience(oidcConfig.credentials().jwt().audience().isPresent()
                        ? removeAudienceTrailingSlash(oidcConfig.credentials().jwt(),
                                oidcConfig.credentials().jwt().audience().get())
                        : tokenRequestUri)

View on GitHub (pinned to e1c734241f)

Solutions

Inspect the wrapped cause (ex.getCause()) to identify whether it is IO (file missing/unreadable) or crypto (wrong password/format)
Verify the key store/file path is on the classpath or an absolute filesystem path that exists in the runtime image
Confirm key-store-password and key-password match how the store was created
Regenerate or re-export the key in a supported format (unencrypted PKCS#8 PEM or JKS/PKCS12 key store)
Test loading the key standalone with keytool/openssl to validate the file

Example fix

// before
quarkus.oidc-client.credentials.jwt.key-file=/app/keys/encrypted-key.pem  // file missing in container
// after
quarkus.oidc-client.credentials.jwt.key-file=classpath:signing-key.pem    // packaged resource, verified

Defensive patterns

Strategy: try-catch

Validate before calling

try (InputStream is = getClass().getResourceAsStream(keyPath)) {
    if (is == null) throw new IllegalStateException("Key file not found: " + keyPath);
}

Try / catch

try { startApp(); } catch (ConfigurationException e) {
    if ("Key can not be loaded".equals(e.getMessage())) {
        log.errorf(e.getCause(), "Check key file existence, path, and passwords");
    }
    throw e;
}

Prevention

Validate key files with keytool/openssl before deploying
Use classpath: resources to guarantee packaging into the artifact
Confirm container images include the key files at the configured paths
Log the underlying cause, not just the wrapper message

When it happens

Trigger: clientJwtKey (invoked via initClientJwtKey) throws while reading credentials.jwt.key / key-file / key-store-file: wrong key-store password, unreadable or missing file, invalid PEM/DER content, unsupported key algorithm, orks.getKey failure.

Common situations: Typo in key-file path or classpath resource; key store created with a different password than configured; PEM key in an unsupported format (e.g. encrypted PKCS#8); file missing in container image after packaging.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/ab64e95ca32a6afe. Report an issue: GitHub.