{"record":{"id":"05e67e14a4b8de39","repo":"quarkusio/quarkus","slug":"the-trust-all-option-cannot-be-used-when-a-trust-s","errorCode":null,"errorMessage":"The trust-all option cannot be used when a trust-store is configured","messagePattern":"The trust-all option cannot be used when a trust-store is configured","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/CertificateRecorder.java","lineNumber":121,"sourceCode":"\n        // Handle reloading if needed\n        if (config.reloadPeriod().isPresent()) {\n            if (reloader == null) {\n                reloader = new TlsCertificateUpdater(vertx);\n            }\n            reloader.add(name, certificates.get(name), config.reloadPeriod().get());\n        }\n    }\n\n    private static TlsConfiguration verifyCertificateConfigInternal(TlsBucketConfig config, Vertx vertx, String name) {\n        // Verify the key store\n        KeyStoreAndKeyCertOptions ks = getKeyStore(config, vertx, name);\n\n        // Verify the trust store\n        TrustStoreAndTrustOptions ts = getTrustStore(config, vertx, name);\n\n        if (config.trustAll() && ts != null) {\n            throw new IllegalStateException(\"The trust-all option cannot be used when a trust-store is configured\");\n        } else if (config.trustAll()) {\n            LOGGER.warnf(\"TLS certificate validation disabled via trust-all configuration - name: %s\", name);\n            LOGGER.warn(\"This configuration is INSECURE and must not be used in production\");\n            ts = new TrustStoreAndTrustOptions(null, TrustAllOptions.INSTANCE);\n        }\n        return new VertxCertificateHolder(vertx, name, config, ks, ts);\n    }\n\n    public static KeyStoreAndKeyCertOptions getKeyStore(TlsBucketConfig bucketConfig, Vertx vertx, String name) {\n        try (var providerInstance = lookupProvider(KeyStoreProvider.class, name)) {\n            if (bucketConfig.keyStore().isPresent()) {\n                var config = bucketConfig.keyStore().get();\n\n                config.validate(providerInstance, name);\n\n                if (config.pem().isPresent()) {\n                    return PemKeyStores.verifyPEMKeyStore(config, vertx, name);\n                } else if (config.p12().isPresent()) {","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/CertificateRecorder.java#L103-L139","documentation":"verifyCertificateConfigInternal() rejects configurations that combine quarkus.tls.trust-all=true with an explicit trust-store, since the two are contradictory: trust-all disables certificate validation entirely while a trust-store defines which CAs to trust. Thrown as IllegalStateException so the misconfiguration is caught at startup rather than silently ignoring the trust-store.","triggerScenarios":"A TLS config bucket sets both trust-all=true and a trust-store (quarkus.tls.trust-store.* paths/certs), or an extension config merges trustAll with a programmatically provided trust store.","commonSituations":"Leaving trust-all=true in from a dev/test profile when adding a real trust-store for production; combining shared config fragments where one sets trust-all and another sets trust-store; misunderstanding that trust-store takes precedence.","solutions":["Set quarkus.tls.trust-all=false (or remove it) now that a trust-store is configured","Remove the trust-store properties if insecure trust-all behavior is truly intended (dev only)","Use Quarkus profiles so trust-all only applies in dev/test, never in prod"],"exampleFix":"// before\nquarkus.tls.trust-all=true\nquarkus.tls.trust-store.paths=trust/cacerts.jks\n// after\nquarkus.tls.trust-all=false\nquarkus.tls.trust-store.paths=trust/cacerts.jks","handlingStrategy":"validation","validationCode":"if (config.trustAll() && (config.trustStore() != null\n        && (config.trustStore().paths().isPresent() || config.trustStore().certs().isPresent()))) {\n    throw new IllegalStateException(\"trust-all cannot be combined with a trust-store\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    // start application with TLS config\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"trust-all\")) {\n        log.error(\"Disable trust-all or remove the trust-store\", e);\n    } else { throw e; }\n}","preventionTips":["Remove trust-all=true before adding a trust-store to any profile","Keep trust-all only in dev/test profiles; never in prod","Audit merged config fragments for contradictory TLS trust settings"],"tags":["quarkus","tls","configuration","truststore","security"],"backgroundTag":"conflicting-tls-trust-configuration","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}