{"record":{"id":"69863979505ecfbd","repo":"quarkusio/quarkus","slug":"invalid-p12-trust-store-configuration-for-certific","errorCode":null,"errorMessage":"Invalid P12 trust store configuration for certificate '${name}' - the trust store password is not set and cannot be retrieved from the credential provider.","messagePattern":"Invalid P12 trust store configuration for certificate '(.+?)' - the trust store password is not set and cannot be retrieved from the credential provider\\.","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java","lineNumber":86,"sourceCode":"            String ap = CredentialProviders.getAliasPassword(config.aliasPassword(), pc).orElse(null);\n            options.setAliasPassword(ap);\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid P12 key store configuration for certificate '\" + name\n                    + \"' - cannot read the key store file '\" + config.path() + \"'\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid P12 key store configuration for certificate '\" + name + \"'\", e);\n        }\n        return options;\n    }\n\n    private static PfxOptions toOptions(P12TrustStoreConfig config, TrustStoreCredentialProviderConfig cp, String name) {\n        PfxOptions options = new PfxOptions();\n        try {\n            options.setValue(Buffer.buffer(read(config.path())));\n            String password = CredentialProviders.getTrustStorePassword(config.password(), cp)\n                    .orElse(null);\n            if (password == null) {\n                throw new IllegalStateException(\"Invalid P12 trust store configuration for certificate '\" + name\n                        + \"' - the trust store password is not set and cannot be retrieved from the credential provider.\");\n            }\n            options.setPassword(password);\n            if (config.alias().isPresent()) {\n                options.setAlias(config.alias().get());\n            }\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid P12 trust store configuration for certificate '\" + name\n                    + \"' - cannot read the trust store file '\" + config.path() + \"'\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid P12 trust store configuration for certificate '\" + name + \"'\", e);\n        }\n        return options;\n    }\n\n    private static void verifyKeyStoreAlias(PfxOptions options, String name,\n            KeyStore ks) {\n        String alias = options.getAlias();","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java#L68-L104","documentation":"During TLS registry startup, Quarkus builds the Vert.x PfxOptions for a P12 trust store. The trust store password is resolved first from the configured password property, then from the configured credential provider; if neither yields a password, an IllegalStateException is thrown because a P12 file cannot be opened without one.","triggerScenarios":"quarkus.tls.*.trust-store.p12.path is configured but quarkus.tls.*.trust-store.p12.password is unset and no trust-store credential provider (or one that returns no password) is configured for the named certificate bundle.","commonSituations":"Trust store password managed in a vault/credential provider that is not registered; config key typo (password under wrong prefix); migrating to the TLS registry and forgetting the password property; empty password resolved by the provider treated as missing.","solutions":["Set quarkus.tls.<name>.trust-store.p12.password in application.properties","Configure a trust-store credential provider that supplies the password","If the P12 has an empty password, explicitly set password= (empty) if supported rather than omitting it","Check the quarkus.tls.<name>.trust-store.credentials-provider mapping for correct name/key"],"exampleFix":"// before\nquarkus.tls.my-cert.trust-store.p12.path=truststore.p12\n// after\nquarkus.tls.my-cert.trust-store.p12.path=truststore.p12\nquarkus.tls.my-cert.trust-store.p12.password=changeit","handlingStrategy":"validation","validationCode":"if (config.trustStore().p12().isPresent()) {\n    boolean hasPassword = config.trustStore().p12().get().password().isPresent()\n        || credentialProviderSuppliesTrustStorePassword();\n    if (!hasPassword) {\n        throw new IllegalArgumentException(\"P12 trust store for 'my-cert' needs a password or credential provider\");\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    tlsRegistry.get(\"my-cert\");\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"trust store password is not set\")) {\n        log.error(\"Set quarkus.tls.my-cert.trust-store.p12.password or a credential provider\");\n    }\n}","preventionTips":["Always set the p12 password alongside the p12 path in TLS config","Use a credential provider backed by the environment/vault for production secrets","Test TLS bundle startup in CI so missing passwords fail the build, not production","Keep trust-store and key-store credential provider configs distinct and correctly named"],"tags":["quarkus","tls","p12","truststore","configuration"],"backgroundTag":"missing-keystore-password","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}