Glad that you implemented. The reference in nifi.properties is something like nifi-kv/default/nifi.security.keystorePasswd. Inside Vault, the secret must have the password under the correct key name (usually value by default for KV v1 in NiFi's client). If you stored it under a different key (e.g., password, secret, or custom), it won't pull the right value. Extra spaces, newlines, or character encoding differences when the value was stored in Vault vs. the original plaintext password For many PKCS12 keystores, nifi.security.keyPasswd must match nifi.security.keystorePasswd. If only one is protected and they differ slightly, or if one resolves and the other doesn't, this error appears. Need to check the above. @TechStream  ... View more