{"record":{"id":"2742ed396d42d81a","repo":"quarkusio/quarkus","slug":"invalid-p12-trust-store-configuration-for-certific-2742ed","errorCode":null,"errorMessage":"Invalid P12 trust store configuration for certificate '${name}'","messagePattern":"Invalid P12 trust store configuration for certificate '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java","lineNumber":97,"sourceCode":"    private static PfxOptions toOptions(P12TrustStoreConfig config, TrustStoreCredentialProviderConfig cp, String name) {\n        PfxOptions options = new PfxOptions();\n        try {\n            options.setValue(Buffer.buffer(read(config.path())));\n            String password = CredentialProviders.getTrustStorePassword(config.password(), cp)\n                    .orElse(null);\n            if (password == null) {\n                throw new IllegalStateException(\"Invalid P12 trust store configuration for certificate '\" + name\n                        + \"' - the trust store password is not set and cannot be retrieved from the credential provider.\");\n            }\n            options.setPassword(password);\n            if (config.alias().isPresent()) {\n                options.setAlias(config.alias().get());\n            }\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid P12 trust store configuration for certificate '\" + name\n                    + \"' - cannot read the trust store file '\" + config.path() + \"'\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid P12 trust store configuration for certificate '\" + name + \"'\", e);\n        }\n        return options;\n    }\n\n    private static void verifyKeyStoreAlias(PfxOptions options, String name,\n            KeyStore ks) {\n        String alias = options.getAlias();\n        String aliasPassword = options.getAliasPassword();\n        if (alias != null) {\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in P12 key store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in P12 key store '\" + name + \"'\", e);\n            }\n","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java#L79-L115","documentation":"Generic fallback in P12 trust store option construction: any exception other than UncheckedIOException while building PfxOptions for the trust store is wrapped as 'Invalid P12 trust store configuration for certificate <name>'. The cause carries the real failure.","triggerScenarios":"Any unexpected exception thrown inside the toOptions(P12TrustStoreConfig,...) try block (e.g., from config access or buffer creation) that is not an UncheckedIOException and not the missing-password case.","commonSituations":"Reactive config access failure, unexpected provider exception, internal errors while assembling the trust store options for the named certificate bundle.","solutions":["Inspect the 'Caused by' of the IllegalStateException for the root cause","Validate all quarkus.tls.<name>.trust-store.p12.* properties (path, password, alias)","Temporarily log config values to find which property is malformed","Simplify to a plain file path + password to isolate the failing option"],"exampleFix":"// before\nquarkus.tls.my-cert.trust-store.p12.alias=wrong-alias\n// after\nquarkus.tls.my-cert.trust-store.p12.alias=trusted-ca","handlingStrategy":"try-catch","validationCode":"// Validate all trust-store p12 options (path readable, password resolvable, alias syntax) before startup\nFiles.isReadable(Path.of(path));\nObjects.requireNonNull(password, \"p12 password required\");","typeGuard":null,"tryCatchPattern":"try {\n    tlsRegistry.get(\"my-cert\");\n} catch (IllegalStateException e) {\n    log.error(\"Trust store setup failed for my-cert; root cause:\", e.getCause());\n}","preventionTips":["Always log/print the cause chain — this is a generic wrapper","Keep the P12 config minimal (path, password, optional alias) to reduce failure surface","Pin JDK/provider versions to avoid unexpected option-building failures"],"tags":["quarkus","tls","p12","truststore","configuration"],"backgroundTag":"invalid-tls-store-configuration","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}