{"record":{"id":"3caab21715029385","repo":"quarkusio/quarkus","slug":"invalid-trust-store-configuration-for-certificate-3caab2","errorCode":null,"errorMessage":"Invalid trust store configuration for certificate '${name}'","messagePattern":"Invalid trust store configuration for certificate '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java","lineNumber":123,"sourceCode":"            if (config.alias().isPresent()) {\n                options.setAlias(config.alias().get());\n            }\n\n            verifyTrustStoreAlias(config.alias(), name, ks);\n\n            if (tsc.certificateExpirationPolicy() == TrustStoreConfig.CertificateExpiryPolicy.IGNORE) {\n                return new TrustStoreAndTrustOptions(ks, options);\n            } else {\n                var wrapped = new ExpiryTrustOptions(options, tsc.certificateExpirationPolicy());\n                return new TrustStoreAndTrustOptions(ks, wrapped);\n            }\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid trust store configuration for certificate '\" + name\n                    + \"' - cannot read the trust store file '\" + config.path().get() + \"'\", e);\n        } catch (IllegalStateException | IllegalArgumentException e) {\n            throw e;\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid trust store configuration for certificate '\" + name + \"'\", e);\n        }\n    }\n\n    private static KeyStore getInstance(String type, Optional<String> provider) {\n        try {\n            if (provider.isPresent()) {\n                return KeyStore.getInstance(type, provider.get());\n            }\n            return KeyStore.getInstance(type);\n        } catch (KeyStoreException | NoSuchProviderException e) {\n            throw new IllegalStateException(\"Unable to create key store of type '\" + type + \"'\"\n                    + (provider.isPresent() ? \" with provider '\" + provider.get() + \"'\" : \"\"), e);\n        }\n    }\n\n    private static void verifyKeyStoreAlias(OtherKeyStoreConfig config, String name, KeyStore ks,\n            String aliasPassword) {\n        if (config.alias().isPresent()) {","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java#L105-L141","documentation":"Thrown by OtherKeyStores.verifyOtherTrustStore as the final catch-all around trust store loading, alias verification and expiry-options wrapping for any exception not handled by the narrower catches (UncheckedIOException and IllegalStateException/IllegalArgumentException are rethrown unchanged). Like its key-store counterpart, the message is a bare wrapper carrying no detail — the attached cause identifies the actual failure (e.g. a KeyStoreException from a malformed store).","triggerScenarios":"ks.load() throws format/parse errors, e.g. trust store bytes are not the declared type.","commonSituations":"PEM bundle fed where PKCS12 declared; corrupt download; truncated secret mount.","solutions":["Read the cause for the underlying error","Verify declared type matches file content","Regenerate/re-download the trust store"],"exampleFix":"// before\nKeyStore ks = OtherKeyStores.load(data, \"p12\"); // file is PEM\n// after\nKeyStore ks = OtherKeyStores.load(pemBytes, \"PEM\");\n","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { init(); } catch (IllegalStateException e) {\n    Throwable root = e; while (root.getCause() != null) root = root.getCause();\n    log.error(\"Trust store load failed: \" + root.getMessage()); throw e;\n}","preventionTips":["Confirm format matches declared type","Checksum-verify downloaded bundles"],"tags":["tls","truststore","format"],"backgroundTag":"keystore-load-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}