{"record":{"id":"5166db13ba35beed","repo":"quarkusio/quarkus","slug":"invalid-jks-key-store-configuration-for-certificat-5166db","errorCode":null,"errorMessage":"Invalid JKS key store configuration for certificate '\" + name + \"'","messagePattern":"Invalid JKS key store configuration for certificate '\" \\+ name \\+ \"'","errorType":"validation","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java","lineNumber":78,"sourceCode":"            String p = CredentialProviders.getKeyStorePassword(config.password(), keyStoreCredentialProviderConfig)\n                    .orElse(null);\n            if (p == null) {\n                throw new IllegalArgumentException(\"Invalid JKS key store configuration for certificate '\" + name\n                        + \"' - the key store password is not set and cannot be retrieved from the credential provider.\");\n            }\n            options.setPassword(p);\n            if (config.alias().isPresent()) {\n                options.setAlias(config.alias().get());\n            }\n            String ap = CredentialProviders.getAliasPassword(config.aliasPassword(), keyStoreCredentialProviderConfig)\n                    .orElse(null);\n            options.setAliasPassword(ap);\n            return options;\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid JKS key store configuration for certificate '\" + name\n                    + \"' - cannot read the key store file '\" + config.path() + \"'\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid JKS key store configuration for certificate '\" + name + \"'\", e);\n        }\n    }\n\n    private static JksOptions toOptions(JKSTrustStoreConfig config,\n            TrustStoreCredentialProviderConfig trustStoreCredentialProviderConfig, String name) {\n        JksOptions options = new JksOptions();\n        try {\n            options.setValue(Buffer.buffer(read(config.path())));\n            String password = CredentialProviders.getTrustStorePassword(config.password(), trustStoreCredentialProviderConfig)\n                    .orElse(null);\n            if (password == null) {\n                throw new IllegalStateException(\"Invalid JKS trust store configuration for certificate '\" + name\n                        + \"' - the trust store password is not set and cannot be retrieved from the credential provider.\");\n            }\n            options.setPassword(password);\n            if (config.alias().isPresent()) {\n                options.setAlias(config.alias().get());\n            }","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java#L60-L96","documentation":"Catch-all wrapper in JKSKeyStores.toOptions for a key store: any exception other than UncheckedIOException (e.g. password problems wrapped elsewhere, I/O errors, malformed options) becomes this IllegalStateException naming the certificate. It masks the concrete failure, so the chained cause is essential.","triggerScenarios":"Any non-file-read failure while converting quarkus.tls.<name>.key-store.jks config to Vert.x JksOptions — e.g. RuntimeException from credential provider lookup, null path handling, or unexpected parser errors.","commonSituations":"Misconfigured credentials-provider causing a nested failure; corrupted JKS file failing outside the read step; regressions after upgrading the TLS registry internals.","solutions":["Inspect the cause chain (e.getCause()) logged by Quarkus for the root error","Fix the underlying issue indicated by the cause (password, path, provider)","Validate the JKS file with keytool -list -keystore keystore.jks","Simplify config to a minimal working case and add settings back incrementally"],"exampleFix":"# before (provider misconfigured -> wrapped error)\nquarkus.tls.my-tls.key-store.jks.path=ks.jks\nquarkus.tls.my-tls.key-store.jks.credentials-provider.name=typo\n# after\nquarkus.tls.my-tls.key-store.jks.path=ks.jks\nquarkus.tls.my-tls.key-store.jks.credentials-provider.name=main","handlingStrategy":"try-catch","validationCode":"// Validate JKS file integrity before deployment\ntry (InputStream in = Files.newInputStream(Path.of(jksPath))) {\n    KeyStore.getInstance(\"JKS\").load(in, null);\n} catch (Exception e) {\n    throw new IllegalStateException(\"Validate with: keytool -list -keystore \" + jksPath);\n}","typeGuard":null,"tryCatchPattern":"try {\n    Quarkus.run(args);\n} catch (IllegalStateException e) {\n    if (e.getMessage() != null && e.getMessage().startsWith(\"Invalid JKS key store configuration\")) {\n        Throwable root = e;\n        while (root.getCause() != null) root = root.getCause();\n        log.errorf(\"JKS config invalid, root cause: %s\", root.toString());\n    }\n    throw e;\n}","preventionTips":["Always inspect the cause chain for the real error","Validate keystores with keytool -list before shipping","Change one TLS config setting at a time and retest"],"tags":["tls","jks","keystore","config"],"backgroundTag":"keystore-config-invalid","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}