{"record":{"id":"60181df044f63744","repo":"quarkusio/quarkus","slug":"failed-to-configure-webauthn-trust-store","errorCode":null,"errorMessage":"Failed to configure WebAuthn trust store","messagePattern":"Failed to configure WebAuthn trust store","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/security-webauthn/runtime/src/main/java/io/quarkus/security/webauthn/WebAuthnSecurity.java","lineNumber":273,"sourceCode":"                try {\n                    trustStore = KeyStore.getInstance(KeyStore.getDefaultType());\n                    trustStore.load(null, null);\n                    addCert(trustStore, ANDROID_KEYSTORE_ROOT);\n                    addCert(trustStore, APPLE_WEBAUTHN_ROOT_CA);\n                    addCert(trustStore, FIDO_MDS3_ROOT_CERTIFICATE);\n                    addCert(trustStore, GSR1);\n                } catch (CertificateException | KeyStoreException | NoSuchAlgorithmException | IOException e) {\n                    throw new RuntimeException(\"Failed to configure default WebAuthn certificates\", e);\n                }\n            }\n            Set<TrustAnchor> trustAnchors = new HashSet<>();\n            try {\n                Enumeration<String> aliases = trustStore.aliases();\n                while (aliases.hasMoreElements()) {\n                    trustAnchors.add(new TrustAnchor((X509Certificate) trustStore.getCertificate(aliases.nextElement()), null));\n                }\n            } catch (KeyStoreException e) {\n                throw new RuntimeException(\"Failed to configure WebAuthn trust store\", e);\n            }\n            // FIXME CLRs are not supported yet\n            something = new KeyStoreTrustAnchorAsyncRepository(trustStore);\n            if (config.loadMetadata().orElse(false)) {\n                HttpAsyncClient httpClient = new VertxHttpAsyncClient(vertx);\n                FidoMDS3MetadataBLOBAsyncProvider blobAsyncProvider = new FidoMDS3MetadataBLOBAsyncProvider(objectConverter,\n                        FidoMDS3MetadataBLOBAsyncProvider.DEFAULT_BLOB_ENDPOINT, httpClient, trustAnchors);\n                something = new MetadataBLOBBasedTrustAnchorAsyncRepository(blobAsyncProvider);\n            }\n\n            return new WebAuthnAsyncManager(\n                    Arrays.asList(\n                            new FIDOU2FAttestationStatementAsyncVerifier(),\n                            new PackedAttestationStatementAsyncVerifier(),\n                            new TPMAttestationStatementAsyncVerifier(),\n                            new AndroidKeyAttestationStatementAsyncVerifier(),\n                            new AndroidSafetyNetAttestationStatementAsyncVerifier(),\n                            new AppleAnonymousAttestationStatementAsyncVerifier()),","sourceCodeStart":255,"sourceCodeEnd":291,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security-webauthn/runtime/src/main/java/io/quarkus/security/webauthn/WebAuthnSecurity.java#L255-L291","documentation":"After building (or loading from TLS config) the WebAuthn trust store, Quarkus iterates its aliases to construct TrustAnchor objects for certificate-path verification of attestation statements. If KeyStore.aliases() or getCertificate() fails (typically because the keystore is not loaded), this RuntimeException wraps the KeyStoreException.","triggerScenarios":"quarkus.security.webauthn.attestation is DIRECT/INDIRECT and makeWebAuthn enumerates trustStore.aliases(); the configured quarkus.tls.webauthn trust store failed to load properly, is unreadable, or the JKS/PKCS12 was not initialized before enumeration.","commonSituations":"A 'webauthn' TLS registry trust store configured with a wrong password or path; a trust store file that is empty or corrupted; keystore type mismatch (JKS vs PKCS12); file permissions preventing the read at startup.","solutions":["Inspect the KeyStoreException cause; verify the trust store file exists, is readable, and the password is correct in quarkus.tls.webauthn.trust-store.*","Open the keystore with keytool -list to confirm it is valid and contains X509 certificate entries","Remove the custom 'webauthn' TLS registry config to fall back to the built-in default certificates","If attestation verification is unnecessary, set quarkus.security.webauthn.attestation=none"],"exampleFix":"// before\nquarkus.tls.webauthn.trust-store.jks.path=/etc/certs/truststore.jks\nquarkus.tls.webauthn.trust-store.jks.password=wrongpass\n// after\nquarkus.tls.webauthn.trust-store.jks.path=/etc/certs/truststore.jks\nquarkus.tls.webauthn.trust-store.jks.password=correctpass","handlingStrategy":"validation","validationCode":"// validate the keystore before startup:\n// keytool -list -keystore truststore.jks -storepass <pass>\n// must succeed and contain X509 entries","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify trust store path/password/type in quarkus.tls.webauthn.trust-store.* with keytool before deploying","Ensure the file is readable by the application user at runtime","Keep JKS/PKCS12 type consistent with the configured keystore type","Fall back to built-in defaults by removing the custom 'webauthn' TLS registry when unsure"],"tags":["webauthn","keystore","truststore","startup"],"backgroundTag":"trust-store-initialization-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}