{"record":{"id":"52aa90c0e3dba9b9","repo":"quarkusio/quarkus","slug":"invalid-jks-key-store-configuration-for-certificat-52aa90","errorCode":null,"errorMessage":"Invalid JKS key store configuration for certificate '\" + name + \"' - cannot read the key store file '\" + config.path() + \"'","messagePattern":"Invalid JKS key store configuration for certificate '\" \\+ name \\+ \"' - cannot read the key store file '\" \\+ config\\.path\\(\\) \\+ \"'","errorType":"validation","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java","lineNumber":75,"sourceCode":"        JksOptions options = new JksOptions();\n        try {\n            options.setValue(Buffer.buffer(read(config.path())));\n            String p = CredentialProviders.getKeyStorePassword(config.password(), keyStoreCredentialProviderConfig)\n                    .orElse(null);\n            if (p == null) {\n                throw new IllegalArgumentException(\"Invalid JKS key store configuration for certificate '\" + name\n                        + \"' - the key store password is not set and cannot be retrieved from the credential provider.\");\n            }\n            options.setPassword(p);\n            if (config.alias().isPresent()) {\n                options.setAlias(config.alias().get());\n            }\n            String ap = CredentialProviders.getAliasPassword(config.aliasPassword(), keyStoreCredentialProviderConfig)\n                    .orElse(null);\n            options.setAliasPassword(ap);\n            return options;\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid JKS key store configuration for certificate '\" + name\n                    + \"' - cannot read the key store file '\" + config.path() + \"'\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid JKS key store configuration for certificate '\" + name + \"'\", e);\n        }\n    }\n\n    private static JksOptions toOptions(JKSTrustStoreConfig config,\n            TrustStoreCredentialProviderConfig trustStoreCredentialProviderConfig, String name) {\n        JksOptions options = new JksOptions();\n        try {\n            options.setValue(Buffer.buffer(read(config.path())));\n            String password = CredentialProviders.getTrustStorePassword(config.password(), trustStoreCredentialProviderConfig)\n                    .orElse(null);\n            if (password == null) {\n                throw new IllegalStateException(\"Invalid JKS trust store configuration for certificate '\" + name\n                        + \"' - the trust store password is not set and cannot be retrieved from the credential provider.\");\n            }\n            options.setPassword(password);","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java#L57-L93","documentation":"JKSKeyStores.toOptions reads the JKS key store file via read(config.path()); if that read throws UncheckedIOException (missing/unreadable file), it is rethrown as this IllegalStateException with the certificate name and path, chaining the original cause.","triggerScenarios":"quarkus.tls.<name>.key-store.jks.path points at a nonexistent/unreadable file while building the key store options at startup.","commonSituations":"Typo in path; file not packaged into the container or native image; relative path resolved against a different working directory in prod; permissions denied for the runtime user.","solutions":["Verify the path exists and is readable at runtime (absolute path recommended)","Package the JKS into the image (container COPY / native-image include) if containerized","Check the 'cause' UncheckedIOException for the exact filesystem error","Confirm the runtime user has read permission"],"exampleFix":"# before\nquarkus.tls.my-tls.key-store.jks.path=keystore.jks\n# after (absolute path inside container)\nquarkus.tls.my-tls.key-store.jks.path=/opt/app/certs/keystore.jks","handlingStrategy":"validation","validationCode":"Path ks = Path.of(cfg.getValue(\"quarkus.tls.my-tls.key-store.jks.path\", String.class));\nif (!Files.isReadable(ks)) throw new IllegalStateException(\"JKS keystore unreadable: \" + ks.toAbsolutePath());","typeGuard":null,"tryCatchPattern":"try {\n    Quarkus.run(args);\n} catch (IllegalStateException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"cannot read the key store file\")) {\n        log.errorf(\"JKS path bad; cause: %s\", e.getCause());\n    }\n    throw e;\n}","preventionTips":["Use absolute paths and verify readability at startup","Package keystores into the image explicitly","Check cause chain for the precise filesystem error"],"tags":["tls","jks","keystore","io"],"backgroundTag":"file-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}