{"record":{"id":"36880bf7e4e1ac2a","repo":"quarkusio/quarkus","slug":"invalid-key-store-configuration-for-certificate-36880b","errorCode":null,"errorMessage":"Invalid key store configuration for certificate '${name}' - the key store password is not set and cannot be retrieved from the credential provider.","messagePattern":"Invalid key store configuration for certificate '(.+?)' - the key store password is not set and cannot be retrieved from the credential provider\\.","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java","lineNumber":45,"sourceCode":"\n    private OtherKeyStores() {\n        // Avoid direct instantiation\n    }\n\n    public static KeyStoreAndKeyCertOptions verifyOtherKeyStore(KeyStoreConfig ksc, String name) {\n        OtherKeyStoreConfig config = ksc.other().orElseThrow();\n\n        if (config.path().isEmpty()) {\n            throw new IllegalStateException(\"Invalid key store configuration for certificate '\" + name\n                    + \"' - no path specified and no KeyStoreFactory found for type '\" + config.type() + \"'\");\n        }\n\n        try {\n            byte[] data = read(config.path().get());\n            String password = CredentialProviders.getKeyStorePassword(config.password(), ksc.credentialsProvider())\n                    .orElse(null);\n            if (password == null) {\n                throw new IllegalStateException(\"Invalid key store configuration for certificate '\" + name\n                        + \"' - the key store password is not set and cannot be retrieved from the credential provider.\");\n            }\n\n            KeyStore ks = getInstance(config.type(), config.provider());\n            ks.load(new ByteArrayInputStream(data), password.toCharArray());\n\n            KeyStoreOptions options = new KeyStoreOptions();\n            options.setType(config.type());\n            if (config.provider().isPresent()) {\n                options.setProvider(config.provider().get());\n            }\n            options.setValue(Buffer.buffer(data));\n            options.setPassword(password);\n            if (config.alias().isPresent()) {\n                options.setAlias(config.alias().get());\n            }\n            String aliasPassword = CredentialProviders.getAliasPassword(config.aliasPassword(), ksc.credentialsProvider())\n                    .orElse(null);","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java#L27-L63","documentation":"Thrown by OtherKeyStores.verifyOtherKeyStore when the 'other' key store's password is neither set in configuration nor obtainable from the configured credentials provider. Loading the store requires its password up front; the credential-provider lookup (ksc.credentialsProvider()) returned empty and no explicit password exists, so the guard aborts startup naming the certificate configuration before any file is read.","triggerScenarios":"verifyOtherKeyStore reads config, CredentialProviders.getKeyStorePassword returns empty for key-store.other with a path set.","commonSituations":"Password supplied via environment variable that is not set in the target environment; credential provider name typo; store genuinely has no password but format requires one.","solutions":["Set quarkus.tls.key-store.other.password","Configure a credentials provider (quarkus.tls.key-store.credentials-provider) that supplies the password","Check that the provider-backed env var/secret exists at runtime"],"exampleFix":"// before\nquarkus.tls.key-store.other.path=certs/ks.p12\n// after\nquarkus.tls.key-store.other.path=certs/ks.p12\nquarkus.tls.key-store.other.password=${KEYSTORE_PASSWORD}\n","handlingStrategy":"validation","validationCode":"boolean passwordResolvable = config.password().isPresent() || credentialsProviderName.isPresent();\nif (!passwordResolvable) throw new IllegalArgumentException(\"Key store password required\");\n","typeGuard":null,"tryCatchPattern":"try { init(); } catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"password is not set\")) { log.error(\"Set key-store-other.password or credentials-provider\"); }\n    throw e;\n}","preventionTips":["Source passwords from env vars/secrets","Test credential provider resolution in CI"],"tags":["tls","keystore","password","credentials-provider"],"backgroundTag":"missing-keystore-password","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}