{"record":{"id":"595cca6338136e68","repo":"quarkusio/quarkus","slug":"invalid-trust-store-configuration-for-certificate-595cca","errorCode":null,"errorMessage":"Invalid trust store configuration for certificate '${name}' - the trust store password is not set and cannot be retrieved from the credential provider.","messagePattern":"Invalid trust store configuration for certificate '(.+?)' - the trust store password is not set and cannot be retrieved from the credential provider\\.","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java","lineNumber":91,"sourceCode":"        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid key store configuration for certificate '\" + name + \"'\", e);\n        }\n    }\n\n    public static TrustStoreAndTrustOptions verifyOtherTrustStore(TrustStoreConfig tsc, String name) {\n        OtherTrustStoreConfig config = tsc.other().orElseThrow();\n\n        if (config.path().isEmpty()) {\n            throw new IllegalStateException(\"Invalid trust store configuration for certificate '\" + name\n                    + \"' - no path specified and no TrustStoreFactory found for type '\" + config.type() + \"'\");\n        }\n\n        try {\n            byte[] data = read(config.path().get());\n            String password = CredentialProviders.getTrustStorePassword(config.password(), tsc.credentialsProvider())\n                    .orElse(null);\n            if (password == null) {\n                throw new IllegalStateException(\"Invalid trust store configuration for certificate '\" + name\n                        + \"' - the trust store password is not set and cannot be retrieved from the credential provider.\");\n            }\n\n            KeyStore ks = getInstance(config.type(), config.provider());\n            ks.load(new ByteArrayInputStream(data), password.toCharArray());\n\n            KeyStoreOptions options = new KeyStoreOptions();\n            options.setType(config.type());\n            if (config.provider().isPresent()) {\n                options.setProvider(config.provider().get());\n            }\n            options.setValue(Buffer.buffer(data));\n            options.setPassword(password);\n            if (config.alias().isPresent()) {\n                options.setAlias(config.alias().get());\n            }\n\n            verifyTrustStoreAlias(config.alias(), name, ks);","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java#L73-L109","documentation":"Thrown by OtherKeyStores.verifyOtherTrustStore when the 'other' trust store's password is unavailable: not set in configuration and not resolvable through the configured credential provider. The store cannot be loaded without its password, so the guard aborts at startup naming the certificate configuration, telling the user to set the password or wire a credentials provider that can supply it.","triggerScenarios":"verifyOtherTrustStore: CredentialProviders.getTrustStorePassword returns empty for trust-store.other with a path.","commonSituations":"Env var absent in prod; provider name misconfigured; password stored under different key.","solutions":["Set quarkus.tls.trust-store-other.password","Configure trust-store credentials provider properly","Verify the secret/env exists in the runtime environment"],"exampleFix":"# before\nquarkus.tls.trust-store-other.path=certs/ts.p12\n# after\nquarkus.tls.trust-store-other.path=certs/ts.p12\nquarkus.tls.trust-store-other.password=changeit\n","handlingStrategy":"validation","validationCode":"if (config.password().isEmpty() && providerNotConfigured) throw new IllegalArgumentException(\"Trust store password required\");\n","typeGuard":null,"tryCatchPattern":"try { init(); } catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"trust store password is not set\")) { log.error(\"Set trust-store-other.password\"); }\n    throw e;\n}","preventionTips":["Note default password 'changeit' for many CAs' p12","Use env/secret injection"],"tags":["tls","truststore","password","credentials-provider"],"backgroundTag":"missing-keystore-password","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}