{"record":{"id":"1e72c38111c78373","repo":"quarkusio/quarkus","slug":"invalid-jks-trust-store-configuration-for-certific-1e72c3","errorCode":null,"errorMessage":"Invalid JKS trust store configuration for certificate '\" + name + \"' - cannot read the trust store file '\" + config.path() + \"'","messagePattern":"Invalid JKS trust store configuration for certificate '\" \\+ name \\+ \"' - cannot read the trust store file '\" \\+ config\\.path\\(\\) \\+ \"'","errorType":"validation","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java","lineNumber":98,"sourceCode":"    }\n\n    private static JksOptions toOptions(JKSTrustStoreConfig config,\n            TrustStoreCredentialProviderConfig trustStoreCredentialProviderConfig, String name) {\n        JksOptions options = new JksOptions();\n        try {\n            options.setValue(Buffer.buffer(read(config.path())));\n            String password = CredentialProviders.getTrustStorePassword(config.password(), trustStoreCredentialProviderConfig)\n                    .orElse(null);\n            if (password == null) {\n                throw new IllegalStateException(\"Invalid JKS trust store configuration for certificate '\" + name\n                        + \"' - the trust store password is not set and cannot be retrieved from the credential provider.\");\n            }\n            options.setPassword(password);\n            if (config.alias().isPresent()) {\n                options.setAlias(config.alias().get());\n            }\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid JKS trust store configuration for certificate '\" + name\n                    + \"' - cannot read the trust store file '\" + config.path() + \"'\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid JKS trust store configuration for certificate '\" + name + \"'\", e);\n        }\n        return options;\n    }\n\n    private static void verifyKeyStoreAlias(JksOptions options, String name, KeyStore ks) {\n        String alias = options.getAlias();\n        // Credential provider already called.\n        String aliasPassword = options.getAliasPassword();\n        if (alias != null) {\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in JKS key store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java#L80-L116","documentation":"Quarkus TLS registry throws this IllegalStateException when building JksOptions for a configured JKS trust store fails because the trust store file could not be read (UncheckedIOException). It wraps the underlying IO error so the startup fails fast with the certificate name and configured path in the message.","triggerScenarios":"Configuring quarkus.tls.*.trust-store.jks with a path that does not exist, is a directory, or is unreadable; the call to read(config.path()) raising UncheckedIOException is caught in JKSTrustStoreConfig.toOptions (JKSKeyStores.java:97-99) during verifyJKSTrustStoreStore.","commonSituations":"Typo in quarkus.tls.<name>.trust-store.jks.path; file mounted after startup in containers; wrong relative path because working directory differs in dev vs prod; permissions denied for the app user; path points at a PKCS#12 file renamed .jks plus unrelated IO failures.","solutions":["Verify the path in quarkus.tls.<name>.trust-store.jks.path is correct and the file exists at runtime (use an absolute path to rule out working-directory differences).","Check file permissions so the user running Quarkus can read the file (chmod/chown).","In containers/Kubernetes, confirm the secret/configmap volume containing the trust store is mounted before startup.","Confirm the file is a real JKS store; if it is PEM or PKCS#12, configure the matching store type instead."],"exampleFix":"// before\nquarkus.tls.my-cert.trust-store.jks.path=truststores/cacerts.jks\n// after\nquarkus.tls.my-cert.trust-store.jks.path=/etc/quarkus/truststores/cacerts.jks","handlingStrategy":"validation","validationCode":"java.nio.file.Path p = java.nio.file.Path.of(path);\nif (!java.nio.file.Files.isRegularFile(p) || !java.nio.file.Files.isReadable(p)) {\n    throw new IllegalStateException(\"JKS trust store not readable: \" + p.toAbsolutePath());\n}","typeGuard":null,"tryCatchPattern":"try {\n    // application startup / TLS config usage\n} catch (IllegalStateException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"cannot read the trust store file\")) {\n        log.errorf(e, \"Fix quarkus.tls.<name>.trust-store.jks.path; current file missing/unreadable\");\n    }\n    throw e;\n}","preventionTips":["Use absolute paths for keystore/truststore files in production config.","Mount trust stores via secrets/configmaps and verify mounts in container entrypoint.","Add a smoke check (Files.isReadable) before startup or in CI.","Keep store files with read permission for the runtime user only."],"tags":["tls","jks","truststore","io","config"],"backgroundTag":"trust-store-file-not-readable","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}