{"record":{"id":"14b6551af3b73f22","repo":"quarkusio/quarkus","slug":"invalid-jks-trust-store-configuration-for-certific","errorCode":null,"errorMessage":"Invalid JKS trust store configuration for certificate '\" + name + \"' - the trust store password is not set and cannot be retrieved from the credential provider.","messagePattern":"Invalid JKS trust store configuration for certificate '\" \\+ name \\+ \"' - the trust store password is not set and cannot be retrieved from the credential provider\\.","errorType":"validation","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java","lineNumber":90,"sourceCode":"            options.setAliasPassword(ap);\n            return options;\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid JKS key store configuration for certificate '\" + name\n                    + \"' - cannot read the key store file '\" + config.path() + \"'\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid JKS key store configuration for certificate '\" + name + \"'\", e);\n        }\n    }\n\n    private static JksOptions toOptions(JKSTrustStoreConfig config,\n            TrustStoreCredentialProviderConfig trustStoreCredentialProviderConfig, String name) {\n        JksOptions options = new JksOptions();\n        try {\n            options.setValue(Buffer.buffer(read(config.path())));\n            String password = CredentialProviders.getTrustStorePassword(config.password(), trustStoreCredentialProviderConfig)\n                    .orElse(null);\n            if (password == null) {\n                throw new IllegalStateException(\"Invalid JKS trust store configuration for certificate '\" + name\n                        + \"' - the trust store password is not set and cannot be retrieved from the credential provider.\");\n            }\n            options.setPassword(password);\n            if (config.alias().isPresent()) {\n                options.setAlias(config.alias().get());\n            }\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid JKS trust store configuration for certificate '\" + name\n                    + \"' - cannot read the trust store file '\" + config.path() + \"'\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid JKS trust store configuration for certificate '\" + name + \"'\", e);\n        }\n        return options;\n    }\n\n    private static void verifyKeyStoreAlias(JksOptions options, String name, KeyStore ks) {\n        String alias = options.getAlias();\n        // Credential provider already called.","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java#L72-L108","documentation":"JKSKeyStores.toOptions for trust stores resolves the trust store password via CredentialProviders.getTrustStorePassword; JKS trust stores require a password, so when neither config nor a credentials provider yields one, this IllegalStateException is thrown.","triggerScenarios":"quarkus.tls.<name>.trust-store.jks.path set but neither trust-store.jks.password nor a resolvable credentials-provider trust-store password is configured.","commonSituations":"Assuming JKS trust stores are passwordless (PKCS12/PEM often don't need one); secret manager returning empty credentials; password lost during config migration between Quarkus versions.","solutions":["Set quarkus.tls.<name>.trust-store.jks.password directly","Or configure trust-store.jks.credentials-provider.name and ensure that provider returns the password","Verify the provider maps the password to the expected property name","Convert the truststore to PKCS12 if a passwordless/integrity-only setup is acceptable"],"exampleFix":"# before\nquarkus.tls.my-tls.trust-store.jks.path=truststore.jks\n# after\nquarkus.tls.my-tls.trust-store.jks.path=truststore.jks\nquarkus.tls.my-tls.trust-store.jks.password=changeit","handlingStrategy":"validation","validationCode":"boolean hasPassword = cfg.getOptionalValue(\"quarkus.tls.my-tls.trust-store.jks.password\", String.class).isPresent()\n    || cfg.getOptionalValue(\"quarkus.tls.my-tls.trust-store.jks.credentials-provider.name\", String.class).isPresent();\nif (!hasPassword) throw new IllegalStateException(\"JKS truststore needs a password or credentials provider\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set trust-store.jks.password or a credentials provider","Remember JKS trust stores need passwords unlike PEM/PKCS12 defaults","Verify secret-manager providers return non-empty passwords"],"tags":["tls","jks","truststore","password"],"backgroundTag":"missing-keystore-password","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}