spring-projects/spring-security · critical · IllegalStateException

Cannot load keys from store:

Error message

Cannot load keys from store: 

What it means

KeyStoreKeyFactory.getKeyPair() loads a KeyStore from the configured Resource and extracts an RSA key pair; any exception during load, password check, alias lookup, or key reconstruction is wrapped in this IllegalStateException. It means the keystore could not be read or the requested keys could not be produced from it. The original cause (password, IO, UnrecoverableKeyException) is attached as the cause.

Source

Thrown at crypto/src/main/java/org/springframework/security/crypto/encrypt/KeyStoreKeyFactory.java:96

							this.store.load(stream, this.password);
						}
					}
				}
			}
			RSAPrivateCrtKey key = (RSAPrivateCrtKey) this.store.getKey(alias, password);
			Certificate certificate = this.store.getCertificate(alias);
			PublicKey publicKey = null;
			if (certificate != null) {
				publicKey = certificate.getPublicKey();
			}
			else if (key != null) {
				RSAPublicKeySpec spec = new RSAPublicKeySpec(key.getModulus(), key.getPublicExponent());
				publicKey = KeyFactory.getInstance("RSA").generatePublic(spec);
			}
			return new KeyPair(publicKey, key);
		}
		catch (Exception ex) {
			throw new IllegalStateException("Cannot load keys from store: " + this.resource, ex);
		}
	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Verify the keystore resource path resolves and the file exists on the classpath/filesystem
2. Confirm the store password is correct; pass a KeyStoreCallbackFactory/password if key password differs from store password
3. Check the alias exists: keytool -list -keystore store.jks and use the exact alias
4. Ensure the store type/provider matches the file format (JKS vs PKCS12), e.g. load with Keystore.getInstance("PKCS12") compatible config

Example fix

// before
KeyPair kp = new KeyStoreKeyFactory(new ClassPathResource("keystore.jks"), "wrongpass").getKeyPair("mykey");
// after
ClassPathResource res = new ClassPathResource("keystore.jks");
Assert.state(res.exists(), "keystore missing");
KeyPair kp = new KeyStoreKeyFactory(res, "correct-store-pass").getKeyPair("mykey");

Resource res = new ClassPathResource("keystore.jks");
Assert.state(res.exists(), "keystore file missing");
try (InputStream in = res.getInputStream()) {
    KeyStore.getInstance("JKS").load(in, password.toCharArray()); // fails early with a precise error
}

try { KeyPair kp = factory.getKeyPair(alias); } catch (IllegalStateException ex) { throw new ConfigurationException("Keystore load failed: " + ex.getCause(), ex); }

When it happens

Trigger: Calling new KeyStoreKeyFactory(resource, password).getKeyPair() where the resource path does not exist, the store password is wrong, the key password/alias does not match, or the store entry is not an RSA PrivateKey with a usable certificate.

Common situations: Wrong keystore path on classpath vs filesystem; keytool-generated store with a different key password than store password; missing BouncyCastle provider for non-JKS formats (PKCS12 legacy); alias typo; JVM keystore type defaults changing (JKS vs PKCS12).

Related errors

• Cannot decrypt
• Only RSA is currently supported, but algorithm was
• Key data does not contain a public key
• Cannot encode key
• Iterations value must be greater than zero

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/5bb432ec3c282c35. Report an issue: GitHub.