{"record":{"id":"46156935127e3cd3","repo":"quarkusio/quarkus","slug":"invalid-p12-key-store-configuration-for-certificat-461569","errorCode":null,"errorMessage":"Invalid P12 key store configuration for certificate '${name}' - cannot read the key store file '${path}'","messagePattern":"Invalid P12 key store configuration for certificate '(.+?)' - cannot read the key store file '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java","lineNumber":71,"sourceCode":"\n    private static PfxOptions toOptions(P12KeyStoreConfig config, KeyStoreCredentialProviderConfig pc, String name) {\n        PfxOptions options = new PfxOptions();\n        try {\n            options.setValue(Buffer.buffer(read(config.path())));\n            String password = CredentialProviders.getKeyStorePassword(config.password(), pc)\n                    .orElse(null);\n            if (password == null) {\n                throw new IllegalStateException(\"Invalid P12 key store configuration for certificate '\" + name\n                        + \"' - the key store password is not set and cannot be retrieved from the credential provider.\");\n            }\n            options.setPassword(password);\n            if (config.alias().isPresent()) {\n                options.setAlias(config.alias().get());\n            }\n            String ap = CredentialProviders.getAliasPassword(config.aliasPassword(), pc).orElse(null);\n            options.setAliasPassword(ap);\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid P12 key store configuration for certificate '\" + name\n                    + \"' - cannot read the key store file '\" + config.path() + \"'\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid P12 key store configuration for certificate '\" + name + \"'\", e);\n        }\n        return options;\n    }\n\n    private static PfxOptions toOptions(P12TrustStoreConfig config, TrustStoreCredentialProviderConfig cp, String name) {\n        PfxOptions options = new PfxOptions();\n        try {\n            options.setValue(Buffer.buffer(read(config.path())));\n            String password = CredentialProviders.getTrustStorePassword(config.password(), cp)\n                    .orElse(null);\n            if (password == null) {\n                throw new IllegalStateException(\"Invalid P12 trust store configuration for certificate '\" + name\n                        + \"' - the trust store password is not set and cannot be retrieved from the credential provider.\");\n            }\n            options.setPassword(password);","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java#L53-L89","documentation":"The configured P12 key store file could not be read: read(config.path()) threw UncheckedIOException, which the registry wraps into this IllegalStateException naming the certificate and path. The key store is unreadable or does not exist.","triggerScenarios":"quarkus.tls.<name>.key-store.p12.path points to a missing file, a directory, or a file without read permission; classpath-relative path that is not on the classpath at runtime; container image not containing the file.","commonSituations":"Absolute path valid on dev machine but absent in container; file in src/main/resources not packaged; typo in path; permissions dropped after mounting a K8s secret; native image not including the resource.","solutions":["Fix quarkus.tls.<name>.key-store.p12.path to an existing, readable file path (absolute or correct classpath location)","Ensure the file is packaged (src/main/resources) or mounted into the container and readable by the runtime user","For native builds, confirm the resource is included in the native image (quarkus.native.resources.includes)","Check filesystem permissions (chmod/chown) on the key store file"],"exampleFix":"// before: path exists only on laptop\nquarkus.tls.my-tls.key-store.p12.path=/Users/me/certs/server.p12\n// after: packaged resource\nquarkus.tls.my-tls.key-store.p12.path=certs/server.p12","handlingStrategy":"validation","validationCode":"Path p = Path.of(configuredPath);\nif (!Files.isRegularFile(p) || !Files.isReadable(p)) {\n    throw new IllegalStateException(\"P12 file missing/unreadable: \" + p.toAbsolutePath());\n}","typeGuard":null,"tryCatchPattern":"try {\n    // init TLS\n} catch (IllegalStateException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"cannot read the key store file\")) {\n        log.error(\"Check path/permissions for the P12 file: \" + e.getCause().getMessage());\n    }\n    throw e;\n}","preventionTips":["Use classpath-relative paths for packaged keystores (src/main/resources)","Include keystore resources in native images (quarkus.native.resources.includes)","Verify container images and K8s mounts contain the file with read permissions","Add a preflight check that stats every configured TLS file path"],"tags":["tls","keystore","p12","file-not-found","config"],"backgroundTag":"file-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}