{"record":{"id":"7388f359cf8a3ee4","repo":"quarkusio/quarkus","slug":"invalid-keystore-name-only-one-keystor","errorCode":null,"errorMessage":"Invalid keystore '\" + name + \"' - Only one keystore type can be configured at a time (PEM, PKCS12, JKS, or other)","messagePattern":"Invalid keystore '\" \\+ name \\+ \"' - Only one keystore type can be configured at a time \\(PEM, PKCS12, JKS, or other\\)","errorType":"validation","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/KeyStoreConfig.java","lineNumber":81,"sourceCode":"    default void validate(InstanceHandle<KeyStoreProvider> provider, String name) {\n        int count = 0;\n        if (pem().isPresent())\n            count++;\n        if (p12().isPresent())\n            count++;\n        if (jks().isPresent())\n            count++;\n        if (other().isPresent())\n            count++;\n\n        if (provider.isAvailable() && count > 0) {\n            throw new IllegalStateException(\n                    \"Invalid keystore '\" + name\n                            + \"' - The keystore cannot be configured with a provider and PEM, PKCS12, JKS, or other at the same time\");\n        }\n\n        if (count > 1) {\n            throw new IllegalStateException(\n                    \"Invalid keystore '\" + name\n                            + \"' - Only one keystore type can be configured at a time (PEM, PKCS12, JKS, or other)\");\n        }\n    }\n\n}\n","sourceCodeStart":63,"sourceCodeEnd":88,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/KeyStoreConfig.java#L63-L88","documentation":"Quarkus TLS registry validation: each named keystore config (quarkus.tls.<name>.key-store.*) may define exactly one of the four mutually exclusive keystore sources — pem, p12, jks, or other. KeyStoreConfig.validate counts how many of these optional groups are present and throws an IllegalStateException when more than one is set, because the registry cannot decide which source supplies the key material.","triggerScenarios":"Setting two or more of quarkus.tls.<name>.key-store.pem.*, .p12.*, .jks.*, or .other.* in application.properties for the same keystore name; validation runs when the TlsRegistryProducers build the certificate config at startup.","commonSituations":"Migrating from a JKS keystore to PEM files and leaving the old jks block behind; copy-pasting a sample p12 config next to an existing pem config; combining an 'other' (e.g. BCFKS/PKCS11) block with a jks block to 'also' support the default type.","solutions":["Remove all but one of the pem/p12/jks/other blocks under quarkus.tls.<name>.key-store","If you need a custom provider, remove the inline key-store type blocks entirely and rely on the KeyStoreProvider bean","Verify resolved config with quarkus.config: run with -Dquarkus.log.category.\"io.quarkus.tls\".level=DEBUG and inspect which groups are present"],"exampleFix":"// before\nquarkus.tls.my.key-store.jks.path=keystore.jks\nquarkus.tls.my.key-store.jks.password=secret\nquarkus.tls.my.key-store.pem.0.cert=cert.crt\nquarkus.tls.my.key-store.pem.0.key=key.pem\n// after\nquarkus.tls.my.key-store.pem.0.cert=cert.crt\nquarkus.tls.my.key-store.pem.0.key=key.pem","handlingStrategy":"validation","validationCode":"int count = 0;\nif (config.keyStore().pem().isPresent()) count++;\nif (config.keyStore().p12().isPresent()) count++;\nif (config.keyStore().jks().isPresent()) count++;\nif (config.keyStore().other().isPresent()) count++;\nif (count > 1) throw new IllegalStateException(\"At most one of pem/p12/jks/other may be set for key-store\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep only one keystore source block per named TLS bucket in application.properties","After migrating keystore formats, delete the old block in the same commit","Use distinct quarkus.tls.<name> buckets per format instead of mixing types in one","Review effective config (SmallRye Config report) in CI to catch leftover blocks"],"tags":["quarkus","tls-registry","configuration","keystore"],"backgroundTag":"mutually-exclusive-config-options","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}