quarkusio/quarkus · error · IllegalArgumentException

Unable to decrypt the key file: + config.key()

Error message

Unable to decrypt the key file: + config.key()

What it means

The TLS registry reads the configured private key file and, when a password is present, assumes it is an encrypted PKCS#8 key. The EncryptedPKCS8Parser returns null when the key material cannot be decrypted (wrong password or not an encrypted PKCS#8 structure), and PemKeyCertConfig.toOptions then throws this IllegalArgumentException instead of loading an unusable key.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemKeyCertConfig.java:72

                if (keyCert == null) {
                    throw new IllegalArgumentException("The key/cert pair with the name '" + name
                            + "' is not found in the `order` list: " + order().get());
                }
                orderedListOfPair.add(keyCert);
            }
        } else {
            // Use the lexical order.
            orderedListOfPair.addAll(new TreeMap<>(keyCerts()).values());
        }

        for (KeyCertConfig config : orderedListOfPair) {
            options.addCertValue(Buffer.buffer(read(config.cert())));
            if (config.password().isPresent()) {
                byte[] content = read(config.key());
                String contentAsString = new String(content, StandardCharsets.UTF_8);
                Buffer decrypted = new EncryptedPKCS8Parser().decryptKey(contentAsString, config.password().get());
                if (decrypted == null) {
                    throw new IllegalArgumentException("Unable to decrypt the key file: " + config.key());
                }
                options.addKeyValue(decrypted);
            } else {
                options.addKeyValue(Buffer.buffer(read(config.key())));
            }
        }
        return options;
    }

    interface KeyCertConfig {

        /**
         * The path to the key file (in PEM format: PKCS#8, PKCS#1 or encrypted PKCS#8).
         */
        Path key();

        /**
         * The path to the certificate file (in PEM format).

View on GitHub (pinned to e1c734241f)

Solutions

1. Convert the key to an encrypted PKCS#8 container: openssl pkcs8 -topk8 -v2 aes-256-cbc -in key.pem -out key.pkcs8.pem
2. Remove the password config if the key is actually unencrypted
3. Verify the password is correct (test decryption with openssl pkey -in key.pkcs8.pem -passin pass:...)
4. Check the CredentialsProvider value if the password comes from config credential-provider references

Example fix

# before
quarkus.tls.my-tls.key-store.pem.0.key=key.pem
quarkus.tls.my-tls.key-store.pem.password=secret
# after (key converted to encrypted PKCS#8)
# openssl pkcs8 -topk8 -in key.pem -out key.pkcs8.pem
quarkus.tls.my-tls.key-store.pem.0.key=key.pkcs8.pem
quarkus.tls.my-tls.key-store.pem.password=secret

// Pre-check key format before referencing it in TLS config
String content = Files.readString(Path.of("key.pem"));
if (content.contains("ENCRYPTED PRIVATE KEY")) {
    // encrypted PKCS#8: ensure configured password decrypts it
} else {
    throw new IllegalStateException(
        "Key must be encrypted PKCS#8 when a password is set; re-encrypt: openssl pkcs8 -topk8 -in key.pem -out key.pkcs8.pem");
}

When it happens

Trigger: Configuring quarkus.tls.key-store.pem.key.* with a key file that is not an encrypted PKCS#8 key while quarkus.tls.key-store.pem.password (or password-key-file) is set; the parser fails to decrypt and returns null.

Common situations: Password set but the key is an unencrypted PEM; key is PKCS#1 ('RSA PRIVATE KEY') or unencrypted PKCS#8 rather than encrypted PKCS#8 ('ENCRYPTED PRIVATE KEY'); wrong password after a credential rotation; password fetched from a CredentialsProvider returning the wrong secret.

Related errors

• Failed to load keystore
• No password provided for keystore
• Failed to initialize trust store from classpath resource " +
• Failed to initialize trust store from " + keyStorePath
• No certificate found with alias: <alias>

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/dc81c92fcaec84a8. Report an issue: GitHub.