We deployed SAM 1.1 a couple of weeks ago on a customer site and it had an issue starting up due to be unable to read the keystore. We discovered the problem because we were seeing the symptoms in RHBZ 875876. and it looked like it was fixed SAM 1.2 so we waited for the release to see if it was. It appears we're still having issues.

thumbslug-0.0.28-1.el6_3.noarch

debug:

Feb 25 16:53:05 [main] WARN  org.candlepin.thumbslug.Main - Shutting down...
Feb 25 16:53:05 [main] INFO  org.candlepin.thumbslug.ssl.SslContextFactory - reading keystore
Feb 25 16:53:06 [main] ERROR org.candlepin.thumbslug.Main - Unable to load the ssl keystore. Check that ssl.keystore and ssl.keystore.password are set correctly.
org.candlepin.thumbslug.ssl.SslKeystoreException: Failed to initialize the server-side SSLContext.
        at org.candlepin.thumbslug.ssl.SslContextFactory.getServerContext(SslContextFactory.java:92)
        at org.candlepin.thumbslug.Main.configureSSL(Main.java:73)
        at org.candlepin.thumbslug.Main.main(Main.java:158)
Caused by: java.io.IOException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded
        at sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:1304)
        at java.security.KeyStore.load(KeyStore.java:1214)
        at org.candlepin.thumbslug.ssl.SslContextFactory.getServerContext(SslContextFactory.java:71)
        ... 2 more
Caused by: javax.crypto.BadPaddingException: Given final block not properly padded
        at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:811)
        at com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:676)
        at com.sun.crypto.provider.PKCS12PBECipherCore.implDoFinal(PKCS12PBECipherCore.java:355)
        at com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_40.engineDoFinal(PKCS12PBECipherCore.java:462)
        at javax.crypto.Cipher.doFinal(Cipher.java:2087)
        at sun.security.pkcs12.PKCS12KeyStore.engineLoad(PKCS12KeyStore.java:1295)
        ... 4 more

RHBZ 859128 looks very similar to the problem but doing:
cp /etc/candlepin/certs/candlepin-ca.crt /etc/thumbslug/client-ca.pem

Makes no difference, I still get:
# service thumbslug status
thumbslug dead but pid file exists