stanfordnlp/CoreNLP · error · IllegalArgumentException

Could not find SSL keystore at

Error message

Could not find SSL keystore at ${StanfordCoreNLPServer.key}

What it means

When SSL is enabled, the server loads a JKS keystore from the path given by the 'key' property/StanfordCoreNLPServer.key. If the keystore cannot be found via URL, classpath, or filesystem, an IllegalArgumentException naming the path is thrown before HTTPS can start.

Solutions

1. Pass the correct absolute path via -key, e.g. -key /etc/corenlp/keystore.jks
2. Verify the file exists: ls at the path or IOUtils.existsInClasspathOrFileSystem equivalent
3. If packaged in a jar, confirm it is on the classpath and reference it by classpath-relative name
4. Create or copy a JKS keystore (password must be 'corenlp' for this server)

Example fix

// before
java -cp corenlp.jar ... StanfordCoreNLPServer -ssl -key keystore.jks  // not in cwd
// after
java -cp corenlp.jar ... StanfordCoreNLPServer -ssl -key /etc/corenlp/keystore.jks

String key = serverKeyProp;
if (sslEnabled) {
  if (key == null || !new File(key).exists() && getClass().getResource(key) == null) {
    throw new IllegalArgumentException("SSL keystore missing: " + key);
  }
}

try {
  startServerSsl(keyPath);
} catch (IllegalArgumentException e) {
  if (e.getMessage().startsWith("Could not find SSL keystore")) {
    log.error("Keystore not found at " + keyPath + "; check path/classpath");
    throw e;
  } else throw e;
}

When it happens

Trigger: Starting the server with -key (or stanford.corenlp.server.key style config) pointing at a file that does not exist on disk, in the classpath, or at the given URL.

Common situations: Relative path resolved from a different working directory; keystore present in a Docker image layer not copied; typo in filename; forgetting the keystore file when redeploying; using the default key name without providing the file.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• can't open file
• Cannot find or open + sentFileName
• Could not find inside
• Could not read from double initial LOP weights file
• Couldn't load classifier from

AI-assisted analysis of stanfordnlp/CoreNLP@1b7edd19c4 (2026-09-10). Data as JSON: /api/errors/0be1e0ab32c47aaa. Report an issue: GitHub.

Appendix: source

Thrown at src/edu/stanford/nlp/pipeline/StanfordCoreNLPServer.java:1660

  private static void sendAndGetResponse(HttpExchange httpExchange, byte[] response) throws IOException {
    if (response.length > 0) {
      httpExchange.getResponseHeaders().add("Content-type", "application/json");
      httpExchange.getResponseHeaders().add("Content-length", Integer.toString(response.length));
      httpExchange.sendResponseHeaders(HTTP_OK, response.length);
      httpExchange.getResponseBody().write(response);
      httpExchange.close();
    }
  }


  private static HttpsServer addSSLContext(HttpsServer server) {
    log("Adding SSL context to server; key=" + StanfordCoreNLPServer.key);
    try (InputStream is = IOUtils.getInputStreamFromURLOrClasspathOrFileSystem(key)) {
      KeyStore ks = KeyStore.getInstance("JKS");
      if (StanfordCoreNLPServer.key != null && IOUtils.existsInClasspathOrFileSystem(StanfordCoreNLPServer.key)) {
        ks.load(is, "corenlp".toCharArray());
      } else {
        throw new IllegalArgumentException("Could not find SSL keystore at " + StanfordCoreNLPServer.key);
      }
      KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
      kmf.init(ks, "corenlp".toCharArray());
      SSLContext sslContext = SSLContext.getInstance("TLS");
      sslContext.init(kmf.getKeyManagers(), null, null);

      // Add SSL support to the server
      server.setHttpsConfigurator(new HttpsConfigurator(sslContext) {
        @Override
        public void configure(HttpsParameters params) {
          SSLContext context = getSSLContext();
          SSLEngine engine = context.createSSLEngine();
          params.setNeedClientAuth(false);
          params.setCipherSuites(engine.getEnabledCipherSuites());
          params.setProtocols(engine.getEnabledProtocols());
          params.setSSLParameters(context.getDefaultSSLParameters());
        }
      });

View on GitHub (pinned to 1b7edd19c4)