{"record":{"id":"0cbc74e3ab7e090a","repo":"quarkusio/quarkus","slug":"invalid-keystore-name-the-keystore-can","errorCode":null,"errorMessage":"Invalid keystore '\" + name + \"' - The keystore cannot be configured with a provider and PEM, PKCS12, JKS, or other at the same time","messagePattern":"Invalid keystore '\" \\+ name \\+ \"' - The keystore cannot be configured with a provider and PEM, PKCS12, JKS, or other at the same time","errorType":"validation","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/KeyStoreConfig.java","lineNumber":75,"sourceCode":"     * The credential provider configuration for the keys store.\n     * A credential provider offers a way to retrieve the key store password and alias password.\n     * Note that the credential provider is only used if the password / alias password are not set in the configuration.\n     */\n    KeyStoreCredentialProviderConfig credentialsProvider();\n\n    default void validate(InstanceHandle<KeyStoreProvider> provider, String name) {\n        int count = 0;\n        if (pem().isPresent())\n            count++;\n        if (p12().isPresent())\n            count++;\n        if (jks().isPresent())\n            count++;\n        if (other().isPresent())\n            count++;\n\n        if (provider.isAvailable() && count > 0) {\n            throw new IllegalStateException(\n                    \"Invalid keystore '\" + name\n                            + \"' - The keystore cannot be configured with a provider and PEM, PKCS12, JKS, or other at the same time\");\n        }\n\n        if (count > 1) {\n            throw new IllegalStateException(\n                    \"Invalid keystore '\" + name\n                            + \"' - Only one keystore type can be configured at a time (PEM, PKCS12, JKS, or other)\");\n        }\n    }\n\n}\n","sourceCodeStart":57,"sourceCodeEnd":88,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/KeyStoreConfig.java#L57-L88","documentation":"A keystore configuration must pick exactly one source: either a Java Security provider-backed keystore, or one of the file/format-based options (PEM, PKCS12, JKS, other). KeyStoreConfig.validate throws IllegalStateException when a provider is available AND at least one format option is also set, since these sources are mutually exclusive.","triggerScenarios":"Configuring quarkus.tls.<name>.key-store with a provider (quarkus.tls.<name>.key-store.provider set/available) while also setting pem, pkcs12, jks, or other properties; also triggered programmatically when validate() runs on such a mixed mapping.","commonSituations":"Copy-pasting example config that includes both provider and pkcs12 options; switching from file-based to provider-based keystore but leaving old pem/pkcs12/jks properties in application.properties or an imported config; environment variables/config source supplying a provider name unexpectedly.","solutions":["Remove the provider setting if you intend to use a file/format-based keystore (keep only pem, pkcs12, jks, or other).","Remove the pem/pkcs12/jks/other properties if you intend to use the provider-backed keystore.","Re-check application.properties, environment variables, and any config profiles (e.g. %prod.) for leftover keystore options; validate the effective config with quarkus config editor or `quarkus config` tooling."],"exampleFix":"// before (application.properties)\nquarkus.tls.my-tls.key-store.provider.name=MDB\nquarkus.tls.my-tls.key-store.pkcs12.path=certs/keystore.p12\n// after\nquarkus.tls.my-tls.key-store.pkcs12.path=certs/keystore.p12\n# or, for provider-backed: remove the pkcs12 line and keep only the provider settings","handlingStrategy":"validation","validationCode":"KeyStoreConfig ks = ...; // from quarkus.tls.<name>.key-store\nif (ks.provider().isAvailable() && (ks.pem().isPresent() || ks.pkcs12().isPresent()\n        || ks.jks().isPresent() || ks.other().isPresent())) {\n    throw new IllegalStateException(\"key-store must use either provider or a file-based format, not both\");\n}","typeGuard":"boolean hasExactlyOneSource(KeyStoreConfig ks) {\n    int count = (ks.pem().isPresent()?1:0) + (ks.pkcs12().isPresent()?1:0)\n              + (ks.jks().isPresent()?1:0) + (ks.other().isPresent()?1:0);\n    return ks.provider().isAvailable() ? count == 0 : count == 1;\n}","tryCatchPattern":"try {\n    TlsConfiguration cfg = TlsConfiguration.fromConfig(\"my-tls\");\n} catch (IllegalStateException e) {\n    log.errorf(\"Keystore config invalid: %s\", e.getMessage());\n}","preventionTips":["Set only one keystore source block per named TLS config (pem XOR pkcs12 XOR jks XOR other XOR provider).","When migrating between keystore sources, delete the old properties instead of commenting them out.","Check environment variables and config profiles for hidden keystore settings that activate the provider path.","Run a build/test that boots the TLS registry early to surface validate() failures at startup."],"tags":["tls","quarkus","config","keystore","validation"],"backgroundTag":"mutually-exclusive-config","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}