# Encrypting system data by using a custom key management service - Failed to add keystore to cache **URL:** \ **Category:** General\ **Tags:** solutions-consultant, pega-platform, security\ **Created:** [July 17, 2023, 4:25pm UTC](https://forums.pega.com/t/encrypting-system-data-by-using-a-custom-key-management-service-failed-to-add-keystore-to-cache/4783 "2023-07-17T16:25:13Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![m.caldag](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/m.caldag/32/2328_2.png) [@m.caldag](https://forums.pega.com/u/m.caldag)\ **Post date:** [July 17, 2023, 4:25pm UTC](https://forums.pega.com/t/encrypting-system-data-by-using-a-custom-key-management-service-failed-to-add-keystore-to-cache/4783/1 "2023-07-17T16:25:13Z")
Hello dears, When I execute java code through activity, getting “Failed to add keystore to cache” error message on run time. After keyUtil.loadMasterKeyForSystemDataEncryption(customMasterKey) has been executed, exception occured. > byte masterKey = “qvhgLaZ21WtDxxsz3Vpjag08ZYiMtKhaFLkvNA4Ieb+RtNcG4a8DxjyGMyAh61kN”.getBytes(); // TODO: assign 16 byte master key > KeyStoreUtils keyUtil = pega.getKeyStoreUtils(); > CustomMasterKey customMasterKey = keyUtil.getMasterKeyObject(); > customMasterKey.setMasterKey(masterKey); > keyUtil.loadMasterKeyForSystemDataEncryption(customMasterKey); How can I solve this issue? ![Issue.png](https://pega1.discourse-cdn.com/pega/original/2X/7/7c0a454d8ee37731b8e68cee1ecbc5c70469385c.png) ---
**Author:** ![VarunK66](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/varunk66/32/16363_2.png) [@VarunK66](https://forums.pega.com/u/VarunK66)\ **Post date:** [March 19, 2024, 11:38pm UTC](https://forums.pega.com/t/encrypting-system-data-by-using-a-custom-key-management-service-failed-to-add-keystore-to-cache/4783/2 "2024-03-19T23:38:37Z")
@m.caldag Did you able to find the issue by now? ---
**Author:** ![SrijitaB1](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/srijitab1/32/8849_2.png) [@SrijitaB1](https://forums.pega.com/u/SrijitaB1)\ **Post date:** [March 20, 2024, 3:14am UTC](https://forums.pega.com/t/encrypting-system-data-by-using-a-custom-key-management-service-failed-to-add-keystore-to-cache/4783/3 "2024-03-20T03:14:40Z")
Hi @m.caldag Not sure why you are using custom java code to load the cipher. You can always navigate to Configure → System → Settings → Data Encryption landing page and mention a platform cipher (a keystore pointing to your custom key management service) and activate it. Once activated successfully you should be able to encrypt all you application properties using the “PropertyEncrypt” type of Access Control Policy. ---
**Author:** ![Manojkumar\_J](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/manojkumar_j/32/15004_2.png) [@Manojkumar\_J](https://forums.pega.com/u/Manojkumar_J)\ **Post date:** [March 20, 2024, 12:58pm UTC](https://forums.pega.com/t/encrypting-system-data-by-using-a-custom-key-management-service-failed-to-add-keystore-to-cache/4783/4 "2024-03-20T12:58:48Z")
@m.caldag Can you try configuring the system data encryption section in the data encryption configuration page ( configure-\> System-\>settings-\>data encryption ) and if you are running the java code using the activity have you mentioned the Keystore file in the parameter page of the activity Thank you ! ---
**Author:** ![m.caldag](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/m.caldag/32/2328_2.png) [@m.caldag](https://forums.pega.com/u/m.caldag)\ **Post date:** [March 22, 2024, 7:14pm UTC](https://forums.pega.com/t/encrypting-system-data-by-using-a-custom-key-management-service-failed-to-add-keystore-to-cache/4783/5 "2024-03-22T19:14:37Z")
Hi @Manojkumar\_ J, I could not try it due to I have been failed on the preparation steps of keystore and no, I have not set file path on some parameter value because I have simply set the string value and have the byte array with using getBytes function as recommended link below. > **[Pegasystems Documentation](https://docs.pega.com/bundle/archive/page/archive/topics/archive-directory.htmlsecurity/87/creating-data-page-activity-master-key-custom-source)** ---
**Author:** ![m.caldag](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/m.caldag/32/2328_2.png) [@m.caldag](https://forums.pega.com/u/m.caldag)\ **Post date:** [March 22, 2024, 7:32pm UTC](https://forums.pega.com/t/encrypting-system-data-by-using-a-custom-key-management-service-failed-to-add-keystore-to-cache/4783/6 "2024-03-22T19:32:16Z")
@VarunK66 I have not found the root cause. Last option would be better to do it with custom java code apart from following documentation but I am not recommending to deploy it on production or distribute usage of custom java approach all over the application especially if the outage of application has possibility to drastically harm the organization financially before performing a solid test. In addition, I am afraid that we cannot use the ootb @encrypt… @decrypt… functions and encrypt property with this custom java approach. ---
**Author:** ![PRATAPB1](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/pratapb1/32/207_2.png) [@PRATAPB1](https://forums.pega.com/u/PRATAPB1)\ **Post date:** [November 4, 2024, 12:26pm UTC](https://forums.pega.com/t/encrypting-system-data-by-using-a-custom-key-management-service-failed-to-add-keystore-to-cache/4783/7 "2024-11-04T12:26:54Z")
Hi @m.caldag, I am also facing same issue, did you find a solution for this or have taken alternate approach. Thanks, Bhanu ---
**Author:** ![BhanuP389](https://avatars.discourse-cdn.com/v4/letter/b/67e7ee/32.png) [@BhanuP389](https://forums.pega.com/u/BhanuP389)\ **Post date:** [November 11, 2024, 1:43pm UTC](https://forums.pega.com/t/encrypting-system-data-by-using-a-custom-key-management-service-failed-to-add-keystore-to-cache/4783/8 "2024-11-11T13:43:29Z")
Hi @m.caldag, we had contacted Pega on this and they have confirmed that custom key management is not going to be deprecated and we have got it working now (new sample code needed). Pega has updated page to confirm the same. > **[Pegasystems Documentation](https://docs.pega.com/bundle/platform/page/platform/release-notes/security/whats-new-security-242.html)** Thanks, Bhanu ---
**Author:** ![m.caldag](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/m.caldag/32/2328_2.png) [@m.caldag](https://forums.pega.com/u/m.caldag)\ **Post date:** [March 22, 2024, 5:37pm UTC](https://forums.pega.com/t/encrypting-system-data-by-using-a-custom-key-management-service-failed-to-add-keystore-to-cache/4783/9 "2024-03-22T17:37:34Z")
Hi @SrijitaB keystore drop down data is initially empty. You have to create a key store first and associate a data page in case key store location is selected as Customer - source master key from other KMS using a data page. Client is not working with any external services like Amazon KMS, Microsoft Azure Key Vault, Google Cloud KMS and HashiCorp Vault so the custom is a one of the option. Tracer is showing the fail after execution of activity which is associated with source data page of Keystore. > **[Pegasystems Documentation](https://docs.pega.com/bundle/archive/page/archive/topics/archive-directory.htmlsecurity/87/creating-data-page-activity-master-key-custom-source)** ---
**Author:** ![m.caldag](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/m.caldag/32/2328_2.png) [@m.caldag](https://forums.pega.com/u/m.caldag)\ **Post date:** [November 5, 2024, 8:48am UTC](https://forums.pega.com/t/encrypting-system-data-by-using-a-custom-key-management-service-failed-to-add-keystore-to-cache/4783/10 "2024-11-05T08:48:24Z")
Hi @PRATAPB1 We are proceeding with “[Configuring a HashiCorp Vault keystore](https://docs.pega.com/bundle/platform/page/platform/security/configure-hashicorp-vault-keystore-tsk.html)” option (installing HashiCorp in some cluster and performing POCs) as “[Encrypting system data by using a custom key management service](https://docs.pega.com/bundle/platform/page/platform/security/encrypt-system-data-using-a-custom-key-management-service.html)” option has been deprecated for some reason. ![deprecated.png](https://pega1.discourse-cdn.com/pega/original/2X/0/0075cfe90427d09de78c19af08418ab47c78831e.png) ---
**Author:** ![PRATAPB1](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/pratapb1/32/207_2.png) [@PRATAPB1](https://forums.pega.com/u/PRATAPB1)\ **Post date:** [November 6, 2024, 3:20pm UTC](https://forums.pega.com/t/encrypting-system-data-by-using-a-custom-key-management-service-failed-to-add-keystore-to-cache/4783/11 "2024-11-06T15:20:22Z")
Thanks @m.caldag, it is very helpful. ---
**Author:** ![m.caldag](https://yyz2.discourse-cdn.com/pega/user_avatar/forums.pega.com/m.caldag/32/2328_2.png) [@m.caldag](https://forums.pega.com/u/m.caldag)\ **Post date:** [November 13, 2024, 4:23pm UTC](https://forums.pega.com/t/encrypting-system-data-by-using-a-custom-key-management-service-failed-to-add-keystore-to-cache/4783/12 "2024-11-13T16:23:37Z")
Hi @BhanuP389 Well done to you to get the fixed and fresh sample codes. However, we will stick with the initial announcement and continue with HashiCorp Vault Source master key from HashiCorp vault Configuration. ![1.webp](https://pega1.discourse-cdn.com/pega/original/2X/c/cdc313d2a2c1a83348666d664310104753eb5d33.webp) Good luck. ---
**Author:** ![OGUNAWARDENA](https://avatars.discourse-cdn.com/v4/letter/o/bc8723/32.png) [@OGUNAWARDENA](https://forums.pega.com/u/OGUNAWARDENA)\ **Post date:** [October 3, 2025, 1:07pm UTC](https://forums.pega.com/t/encrypting-system-data-by-using-a-custom-key-management-service-failed-to-add-keystore-to-cache/4783/13 "2025-10-03T13:07:07Z")
@BhanuP389 Hi Bhanu, Thanks for confirming this. Could you please share the new sample code you mentioned that got it working? That would be really helpful. Thanks, [Your Name]