{"record":{"id":"604598f758e4f055","repo":"quarkusio/quarkus","slug":"invalid-jks-key-store-configuration-for-certificat","errorCode":null,"errorMessage":"Invalid JKS key store configuration for certificate '\" + name + \"' - the key store password is not set and cannot be retrieved from the credential provider.","messagePattern":"Invalid JKS key store configuration for certificate '\" \\+ name \\+ \"' - the key store password is not set and cannot be retrieved from the credential provider\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java","lineNumber":63,"sourceCode":"        verifyTrustStoreAlias(options, name, ks);\n        if (config.certificateExpirationPolicy() == TrustStoreConfig.CertificateExpiryPolicy.IGNORE) {\n            return new TrustStoreAndTrustOptions(ks, options);\n        } else {\n            var wrapped = new ExpiryTrustOptions(options, config.certificateExpirationPolicy());\n            return new TrustStoreAndTrustOptions(ks, wrapped);\n        }\n\n    }\n\n    private static JksOptions toOptions(JKSKeyStoreConfig config,\n            KeyStoreCredentialProviderConfig keyStoreCredentialProviderConfig, String name) {\n        JksOptions options = new JksOptions();\n        try {\n            options.setValue(Buffer.buffer(read(config.path())));\n            String p = CredentialProviders.getKeyStorePassword(config.password(), keyStoreCredentialProviderConfig)\n                    .orElse(null);\n            if (p == null) {\n                throw new IllegalArgumentException(\"Invalid JKS key store configuration for certificate '\" + name\n                        + \"' - the key store password is not set and cannot be retrieved from the credential provider.\");\n            }\n            options.setPassword(p);\n            if (config.alias().isPresent()) {\n                options.setAlias(config.alias().get());\n            }\n            String ap = CredentialProviders.getAliasPassword(config.aliasPassword(), keyStoreCredentialProviderConfig)\n                    .orElse(null);\n            options.setAliasPassword(ap);\n            return options;\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid JKS key store configuration for certificate '\" + name\n                    + \"' - cannot read the key store file '\" + config.path() + \"'\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid JKS key store configuration for certificate '\" + name + \"'\", e);\n        }\n    }\n","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java#L45-L81","documentation":"When building Vert.x JksOptions for a key store, JKSKeyStores.toOptions asks CredentialProviders.getKeyStorePassword for the password (from config or a credentials provider). If neither yields a value, it throws this IllegalArgumentException because a JKS keystore cannot be opened without its password.","triggerScenarios":"quarkus.tls.<name>.key-store.jks.path set but neither jks.password nor a resolvable credentials-provider password is configured; the credentials provider returns no password property.","commonSituations":"Password intentionally stored in a secret manager but the provider lookup fails/returns empty; password property name mismatch (e.g. provider returns 'password' but code expects the standard key); config migration dropped the password key.","solutions":["Set quarkus.tls.<name>.key-store.jks.password directly","Or configure credentials-provider.name and ensure the named provider returns the PASSWORD property","Verify the provider returns the password under the expected key (CredentialsProvider.PASSWORD_PROPERTY_NAME)","Confirm the JKS file actually requires/uses that password"],"exampleFix":"# before\nquarkus.tls.my-tls.key-store.jks.path=keystore.jks\n# after\nquarkus.tls.my-tls.key-store.jks.path=keystore.jks\nquarkus.tls.my-tls.key-store.jks.password=changeit","handlingStrategy":"validation","validationCode":"boolean hasPassword = cfg.getOptionalValue(\"quarkus.tls.my-tls.key-store.jks.password\", String.class).isPresent()\n    || cfg.getOptionalValue(\"quarkus.tls.my-tls.key-store.jks.credentials-provider.name\", String.class).isPresent();\nif (!hasPassword) throw new IllegalStateException(\"JKS keystore needs a password or credentials provider\");","typeGuard":null,"tryCatchPattern":"try {\n    Quarkus.run(args);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"key store password is not set\")) {\n        log.error(\"Set jks.password or a working credentials provider\");\n    }\n    throw e;\n}","preventionTips":["Always pair jks.path with jks.password or credentials-provider config","Verify providers return the PASSWORD property","Test keystore password resolution in CI with a dummy JKS"],"tags":["tls","jks","keystore","password"],"backgroundTag":"missing-keystore-password","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}