{"record":{"id":"89fa12dd289d1aa9","repo":"quarkusio/quarkus","slug":"invalid-key-store-configuration-for-certificate-89fa12","errorCode":null,"errorMessage":"Invalid key store configuration for certificate '${name}'","messagePattern":"Invalid key store configuration for certificate '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java","lineNumber":74,"sourceCode":"            }\n            options.setValue(Buffer.buffer(data));\n            options.setPassword(password);\n            if (config.alias().isPresent()) {\n                options.setAlias(config.alias().get());\n            }\n            String aliasPassword = CredentialProviders.getAliasPassword(config.aliasPassword(), ksc.credentialsProvider())\n                    .orElse(null);\n            options.setAliasPassword(aliasPassword);\n\n            verifyKeyStoreAlias(config, name, ks, aliasPassword);\n            return new KeyStoreAndKeyCertOptions(ks, options);\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid key store configuration for certificate '\" + name\n                    + \"' - cannot read the key store file '\" + config.path().get() + \"'\", e);\n        } catch (IllegalStateException | IllegalArgumentException e) {\n            throw e;\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid key store configuration for certificate '\" + name + \"'\", e);\n        }\n    }\n\n    public static TrustStoreAndTrustOptions verifyOtherTrustStore(TrustStoreConfig tsc, String name) {\n        OtherTrustStoreConfig config = tsc.other().orElseThrow();\n\n        if (config.path().isEmpty()) {\n            throw new IllegalStateException(\"Invalid trust store configuration for certificate '\" + name\n                    + \"' - no path specified and no TrustStoreFactory found for type '\" + config.type() + \"'\");\n        }\n\n        try {\n            byte[] data = read(config.path().get());\n            String password = CredentialProviders.getTrustStorePassword(config.password(), tsc.credentialsProvider())\n                    .orElse(null);\n            if (password == null) {\n                throw new IllegalStateException(\"Invalid trust store configuration for certificate '\" + name\n                        + \"' - the trust store password is not set and cannot be retrieved from the credential provider.\");","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java#L56-L92","documentation":"Thrown by OtherKeyStores.verifyOtherKeyStore as the catch-all wrapper for any unexpected exception during 'other' key store setup — loading, alias verification or options construction — that is not already an UncheckedIOException, IllegalStateException or IllegalArgumentException (those are rethrown as-is). The original exception is attached as the cause; the message alone carries no detail, so the caused-by chain must be consulted to find the underlying failure.","triggerScenarios":"ks.load() throws e.g. InvalidKeySpecException/IOException due to wrong format, wrong type declared, or alias verification failure not covered elsewhere.","commonSituations":"Declaring type=p12 for an actual JKS file; corrupted store; unsupported provider output.","solutions":["Inspect the cause chain for the root exception","Confirm the file format matches quarkus.tls.key-store.other.type","Re-export/convert the store with keytool or openssl"],"exampleFix":"# before\nquarkus.tls.key-store.other.type=p12  # file is actually JKS\n# after\nquarkus.tls.key-store.other.type=JKS\n","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { init(); } catch (IllegalStateException e) {\n    Throwable root = e; while (root.getCause() != null) root = root.getCause();\n    log.error(\"Key store load failed: \" + root.getMessage()); throw e;\n}","preventionTips":["Always inspect root cause","Match declared type to real file format","Keep stores under version control or verified artifact storage"],"tags":["tls","keystore","format"],"backgroundTag":"keystore-load-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}