{"record":{"id":"071edd352290835e","repo":"quarkusio/quarkus","slug":"invalid-jks-trust-store-configuration-for-certific-071edd","errorCode":null,"errorMessage":"Invalid JKS trust store configuration for certificate '\" + name + \"'","messagePattern":"Invalid JKS trust store configuration for certificate '\" \\+ name \\+ \"'","errorType":"validation","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java","lineNumber":101,"sourceCode":"            TrustStoreCredentialProviderConfig trustStoreCredentialProviderConfig, String name) {\n        JksOptions options = new JksOptions();\n        try {\n            options.setValue(Buffer.buffer(read(config.path())));\n            String password = CredentialProviders.getTrustStorePassword(config.password(), trustStoreCredentialProviderConfig)\n                    .orElse(null);\n            if (password == null) {\n                throw new IllegalStateException(\"Invalid JKS trust store configuration for certificate '\" + name\n                        + \"' - the trust store password is not set and cannot be retrieved from the credential provider.\");\n            }\n            options.setPassword(password);\n            if (config.alias().isPresent()) {\n                options.setAlias(config.alias().get());\n            }\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid JKS trust store configuration for certificate '\" + name\n                    + \"' - cannot read the trust store file '\" + config.path() + \"'\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid JKS trust store configuration for certificate '\" + name + \"'\", e);\n        }\n        return options;\n    }\n\n    private static void verifyKeyStoreAlias(JksOptions options, String name, KeyStore ks) {\n        String alias = options.getAlias();\n        // Credential provider already called.\n        String aliasPassword = options.getAliasPassword();\n        if (alias != null) {\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in JKS key store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in JKS key store '\" + name + \"'\", e);\n            }\n","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java#L83-L119","documentation":"Generic fallback: when building JksOptions for a JKS trust store, any exception other than UncheckedIOException is wrapped into this IllegalStateException naming only the certificate. The cause holds the real problem (e.g. missing password, credential provider failure).","triggerScenarios":"During verifyJKSTrustStoreStore -> toOptions (JKSKeyStores.java:100-101) when reading the path, resolving the password via credential provider, or reading alias/aliasPassword throws a non-IO exception. Notably a missing trust store password throws this wrapper after the inner IllegalStateException is raised.","commonSituations":"quarkus.tls.<name>.trust-store.jks.password not set and no credential provider configured; credential provider bean misconfigured or unreachable; malformed config expression in password.","solutions":["Read the cause (getCause()) of the IllegalStateException — the wrapper hides the real error.","Set quarkus.tls.<name>.trust-store.jks.password, or configure quarkus.tls.<name>.trust-store.credentials-provider.name so the password can be retrieved.","Validate the trust store config block for typos (password, alias, alias-password keys)."],"exampleFix":"// before\nquarkus.tls.my-cert.trust-store.jks.path=/etc/quarkus/cacerts.jks\n// after\nquarkus.tls.my-cert.trust-store.jks.path=/etc/quarkus/cacerts.jks\nquarkus.tls.my-cert.trust-store.jks.password=changeit","handlingStrategy":"try-catch","validationCode":"if (configPassword == null && credentialProviderName == null) {\n    throw new IllegalStateException(\"JKS trust store requires quarkus.tls.<name>.trust-store.jks.password or a credentials provider\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    // startup\n} catch (IllegalStateException e) {\n    log.errorf(e, \"JKS trust store config invalid; cause=%s\", e.getCause());\n    throw e;\n}","preventionTips":["Always set trust-store.jks.password or a credentials provider name.","Always log/print e.getCause() for this generic wrapper.","Keep trust store config blocks minimal and validated in CI with a test profile startup.","Avoid dynamic password expressions that can fail silently."],"tags":["tls","jks","truststore","config"],"backgroundTag":"trust-store-file-not-readable","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}