{"record":{"id":"7fa2cfef8f7cabb4","repo":"quarkusio/quarkus","slug":"unable-to-load-p12-type-store-name-verify","errorCode":null,"errorMessage":"Unable to load P12 ${type} store '${name}', verify the password.","messagePattern":"Unable to load P12 (.+?) store '(.+?)', verify the password\\.","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java","lineNumber":158,"sourceCode":"        if (maybeAlias.isPresent()) {\n            String alias = maybeAlias.get();\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in P12 trust store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {\n                throw new IllegalStateException(\"Unable to verify alias '\" + alias + \"' in P12 trust store '\" + name + \"'\", e);\n            }\n        }\n    }\n\n    private static KeyStore loadKeyStore(Vertx vertx, String name, PfxOptions options, String type) {\n        KeyStore ks;\n        try {\n            ks = options.loadKeyStore(vertx);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Unable to load P12 \" + type + \" store '\" + name + \"', verify the password.\", e);\n        }\n        return ks;\n    }\n}\n","sourceCodeStart":140,"sourceCodeEnd":163,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java#L140-L163","documentation":"Wraps any exception raised while loading a P12 (PKCS#12) keystore or trust store through Vert.x PfxOptions, telling the user to check the password. Quarkus TLS registry calls loadKeyStore and converts any failure (wrong password, missing file, malformed PKCS#12) into this IllegalStateException with the store's logical name and type (keystore or trust store).","triggerScenarios":"options.loadKeyStore(vertx) throws for a PfxOptions built from quarkus.tls.<name>.key-store.p12.* or trust-store.p12.* config — wrong password, unreadable path, or invalid PKCS#12 content.","commonSituations":"Password changed after rotation but config not updated; file path relative to a working directory that differs at runtime; base64/PEM file supplied instead of real .p12 binary; store exported with an empty password while config provides one.","solutions":["Check that quarkus.tls.<name>.(key-store|trust-store).p12.password matches the actual store password","Verify the p12.path points to an existing, readable PKCS#12 file at runtime (absolute path to test)","Validate the file with keytool -list -keystore file.p12 -storetype PKCS12 -storepass <password>","Re-export the store correctly: keytool -importkeystore -deststoretype PKCS12"],"exampleFix":"// before\nquarkus.tls.my-tls.key-store.p12.path=conf/ks.p12\nquarkus.tls.my-tls.key-store.p12.password=oldpass\n// after (after rotation)\nquarkus.tls.my-tls.key-store.p12.path=/etc/app/certs/ks.p12\nquarkus.tls.my-tls.key-store.p12.password=newpass","handlingStrategy":"validation","validationCode":"File f = new File(p12Path);\nif (!f.isFile() || !f.canRead()) throw new IllegalStateException(\"Missing p12: \" + p12Path);\ntry (InputStream in = new FileInputStream(f)) {\n    KeyStore.getInstance(\"PKCS12\").load(in, password.toCharArray()); // throws on bad password\n}","typeGuard":null,"tryCatchPattern":"try {\n    // start app / use TLS config\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"verify the password\")) {\n        log.errorf(e.getCause(), \"P12 store %s failed to load; check password/path\", storeName);\n    }\n}","preventionTips":["Store passwords in a secret manager or config credential provider, not plain properties","Test store loading in CI with the same file and password used in production","Keep passwords in sync during rotation (update store and config atomically)","Use absolute paths for p12.path"],"tags":["tls","keystore","p12","password"],"backgroundTag":"keystore-password-invalid","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}