Error when uploading PEM cert to Custom Key Manager configuration

[maneeshaheshan]

Description

Hi team,

We are trying to configure a custom key manager in the admin portal by uploading the PEM file for JWT signature validation (alternative to using the JWKS URL). In that case, when saving the custom key manager, it saves fine in the UI without errors. However, while checking the carbon logs, could observe the following:

ERROR - APIUtil Error while converting into X509Certificate
javax.security.cert.CertificateException: Could not find class: java.lang.ClassNotFoundException: com/sun/security/cert/internal/x509/X509V1CertImpl
	at javax.security.cert.X509Certificate.getInst(X509Certificate.java:242) ~[?:?]
	at javax.security.cert.X509Certificate.getInstance(X509Certificate.java:183) ~[?:?]
	at org.wso2.carbon.apimgt.impl.utils.APIUtil.retrieveCertificateFromContent_aroundBody784(APIUtil.java:9308) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	at org.wso2.carbon.apimgt.impl.utils.APIUtil.retrieveCertificateFromContent(APIUtil.java:1) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	at org.wso2.carbon.apimgt.impl.factory.KeyManagerHolder.getJWTValidator_aroundBody8(KeyManagerHolder.java:214) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	at org.wso2.carbon.apimgt.impl.factory.KeyManagerHolder.getJWTValidator(KeyManagerHolder.java:1) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	at org.wso2.carbon.apimgt.impl.factory.KeyManagerHolder.addKeyManagerConfiguration_aroundBody0(KeyManagerHolder.java:109) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	at org.wso2.carbon.apimgt.impl.factory.KeyManagerHolder.addKeyManagerConfiguration(KeyManagerHolder.java:1) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	at org.wso2.carbon.apimgt.impl.factory.KeyManagerHolder.updateKeyManagerConfiguration_aroundBody4(KeyManagerHolder.java:155) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	at org.wso2.carbon.apimgt.impl.factory.KeyManagerHolder.updateKeyManagerConfiguration(KeyManagerHolder.java:1) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	at org.wso2.carbon.apimgt.impl.keymgt.KeyManagerConfigurationServiceImpl.updateKeyManagerConfiguration_aroundBody2(KeyManagerConfigurationServiceImpl.java:46) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	at org.wso2.carbon.apimgt.impl.keymgt.KeyManagerConfigurationServiceImpl.updateKeyManagerConfiguration(KeyManagerConfigurationServiceImpl.java:1) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	at org.wso2.carbon.apimgt.jms.listener.utils.KeyManagerJMSMessageListener.onMessage(KeyManagerJMSMessageListener.java:82) ~[org.wso2.carbon.apimgt.jms.listener_9.28.116.94.jar:?]
	at org.wso2.carbon.apimgt.common.jms.JMSTaskManager$MessageListenerTask.handleMessage(JMSTaskManager.java:656) ~[org.wso2.carbon.apimgt.common.jms_9.28.116.94.jar:?]
	at org.wso2.carbon.apimgt.common.jms.JMSTaskManager$MessageListenerTask.run(JMSTaskManager.java:555) ~[org.wso2.carbon.apimgt.common.jms_9.28.116.94.jar:?]
	at org.apache.axis2.transport.base.threads.NativeWorkerPool$1.run(NativeWorkerPool.java:172) ~[axis2_1.6.1.wso2v83_7.jar:?]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) ~[?:?]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) ~[?:?]
	at java.lang.Thread.run(Thread.java:840) [?:?]

[2026-07-14 19:48:36,669] ERROR - KeyManagerJMSMessageListener Error occurred while registering Key Manager
org.wso2.carbon.apimgt.api.APIManagementException: Error while converting into X509Certificate
	at org.wso2.carbon.apimgt.impl.utils.APIUtil.retrieveCertificateFromContent_aroundBody784(APIUtil.java:9312) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	at org.wso2.carbon.apimgt.impl.utils.APIUtil.retrieveCertificateFromContent(APIUtil.java:1) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	at org.wso2.carbon.apimgt.impl.factory.KeyManagerHolder.getJWTValidator_aroundBody8(KeyManagerHolder.java:214) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	at org.wso2.carbon.apimgt.impl.factory.KeyManagerHolder.getJWTValidator(KeyManagerHolder.java:1) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	at org.wso2.carbon.apimgt.impl.factory.KeyManagerHolder.addKeyManagerConfiguration_aroundBody0(KeyManagerHolder.java:109) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	at org.wso2.carbon.apimgt.impl.factory.KeyManagerHolder.addKeyManagerConfiguration(KeyManagerHolder.java:1) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	at org.wso2.carbon.apimgt.impl.factory.KeyManagerHolder.updateKeyManagerConfiguration_aroundBody4(KeyManagerHolder.java:155) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	at org.wso2.carbon.apimgt.impl.factory.KeyManagerHolder.updateKeyManagerConfiguration(KeyManagerHolder.java:1) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	at org.wso2.carbon.apimgt.impl.keymgt.KeyManagerConfigurationServiceImpl.updateKeyManagerConfiguration_aroundBody2(KeyManagerConfigurationServiceImpl.java:46) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	at org.wso2.carbon.apimgt.impl.keymgt.KeyManagerConfigurationServiceImpl.updateKeyManagerConfiguration(KeyManagerConfigurationServiceImpl.java:1) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	at org.wso2.carbon.apimgt.jms.listener.utils.KeyManagerJMSMessageListener.onMessage(KeyManagerJMSMessageListener.java:82) ~[org.wso2.carbon.apimgt.jms.listener_9.28.116.94.jar:?]
	at org.wso2.carbon.apimgt.common.jms.JMSTaskManager$MessageListenerTask.handleMessage(JMSTaskManager.java:656) ~[org.wso2.carbon.apimgt.common.jms_9.28.116.94.jar:?]
	at org.wso2.carbon.apimgt.common.jms.JMSTaskManager$MessageListenerTask.run(JMSTaskManager.java:555) ~[org.wso2.carbon.apimgt.common.jms_9.28.116.94.jar:?]
	at org.apache.axis2.transport.base.threads.NativeWorkerPool$1.run(NativeWorkerPool.java:172) ~[axis2_1.6.1.wso2v83_7.jar:?]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) ~[?:?]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) ~[?:?]
	at java.lang.Thread.run(Thread.java:840) [?:?]
Caused by: javax.security.cert.CertificateException: Could not find class: java.lang.ClassNotFoundException: com/sun/security/cert/internal/x509/X509V1CertImpl
	at javax.security.cert.X509Certificate.getInst(X509Certificate.java:242) ~[?:?]
	at javax.security.cert.X509Certificate.getInstance(X509Certificate.java:183) ~[?:?]
	at org.wso2.carbon.apimgt.impl.utils.APIUtil.retrieveCertificateFromContent_aroundBody784(APIUtil.java:9308) ~[org.wso2.carbon.apimgt.impl_9.28.116.403.jar:?]
	... 16 more

Afterwards, when go to register an out-of-band consumer key in the DevPortal for this custom key manager, it throws the following error In the UI as well

"Key Manager not Registered"

Steps to Reproduce

• Create a test PEM certificate (any valid X.509 PEM works — the content doesn't matter, only that APIM tries to parse it; the easiest is exporting the pack's own cert):

keytool -exportcert -rfc -alias wso2carbon \
  -keystore repository/resources/security/wso2carbon.jks \
  -storepass wso2carbon -file /tmp/test-km-cert.pem

• Start APIM server with Java 17.

• Create a custom Key Manager with the PEM using the admin Portal.

• Name: TestKM, Display Name: TestKM

• Key Manager Type: any external type (e.g. Custom)

• Issuer: a dummy issuer, e.g. https://test-issuer.example/oauth2/token

• Fill any other required endpoint fields with dummy URLs

• Token Validation / Certificates section: select PEM and upload (or paste the contents of) /tmp/test-km-cert.pem (this is the trigger; make sure token validation is the default Self-validate JWT)

• Save.

Expected result: the UI saves without error, but the log tail immediately shows the exception above.

Version

4.2.0

Environment Details (with versions)

Java 17
Product : wso2am-4.2.0
Update level : 188

[NethmiRanasinghe]

This is a duplicate of the issue #2665 which has already been fixed via wso2/carbon-apimgt#12350.