{"record":{"id":"8a99161159b5117a","repo":"quarkusio/quarkus","slug":"invalid-p12-key-store-configuration-for-certificat","errorCode":null,"errorMessage":"Invalid P12 key store configuration for certificate '${name}' - the key store password is not set and cannot be retrieved from the credential provider.","messagePattern":"Invalid P12 key store configuration for certificate '(.+?)' - the key store password is not set and cannot be retrieved from the credential provider\\.","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java","lineNumber":61,"sourceCode":"        PfxOptions options = toOptions(p12Config, config.credentialsProvider(), name);\n        KeyStore ks = loadKeyStore(vertx, name, options, \"trust\");\n        verifyTrustStoreAlias(p12Config.alias(), name, ks);\n        if (config.certificateExpirationPolicy() == TrustStoreConfig.CertificateExpiryPolicy.IGNORE) {\n            return new TrustStoreAndTrustOptions(ks, options);\n        } else {\n            var wrapped = new ExpiryTrustOptions(options, config.certificateExpirationPolicy());\n            return new TrustStoreAndTrustOptions(ks, wrapped);\n        }\n    }\n\n    private static PfxOptions toOptions(P12KeyStoreConfig config, KeyStoreCredentialProviderConfig pc, String name) {\n        PfxOptions options = new PfxOptions();\n        try {\n            options.setValue(Buffer.buffer(read(config.path())));\n            String password = CredentialProviders.getKeyStorePassword(config.password(), pc)\n                    .orElse(null);\n            if (password == null) {\n                throw new IllegalStateException(\"Invalid P12 key store configuration for certificate '\" + name\n                        + \"' - the key store password is not set and cannot be retrieved from the credential provider.\");\n            }\n            options.setPassword(password);\n            if (config.alias().isPresent()) {\n                options.setAlias(config.alias().get());\n            }\n            String ap = CredentialProviders.getAliasPassword(config.aliasPassword(), pc).orElse(null);\n            options.setAliasPassword(ap);\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid P12 key store configuration for certificate '\" + name\n                    + \"' - cannot read the key store file '\" + config.path() + \"'\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid P12 key store configuration for certificate '\" + name + \"'\", e);\n        }\n        return options;\n    }\n\n    private static PfxOptions toOptions(P12TrustStoreConfig config, TrustStoreCredentialProviderConfig cp, String name) {","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java#L43-L79","documentation":"When building Vert.x PfxOptions for a P12 key store, the TLS registry resolves the key store password from configuration or a credential provider. If neither yields a password, it throws this error because a P12 key store cannot be opened without one.","triggerScenarios":"quarkus.tls.<name>.key-store.p12.password is unset/blank and no credential provider is configured (or the provider returns empty) when P12KeyStores.toOptions builds the key store options.","commonSituations":"Relying on a credential provider that is not registered or whose name does not match; password provided via env var that is empty in the target environment; migrating config and forgetting the password property; K8s secret not mounted.","solutions":["Set quarkus.tls.<name>.key-store.p12.password=<password> in configuration","Configure the credential provider (e.g. quarkus.tls.key-store.credential-provider.name / credentials provider group) so the secret can be resolved","Check the environment variable / mounted secret actually has a value in the deployment","If the P12 truly has an empty password, provide an explicit empty-string password if your tooling produced one"],"exampleFix":"// before\nquarkus.tls.my-tls.key-store.p12.path=certs/server.p12\n// after\nquarkus.tls.my-tls.key-store.p12.path=certs/server.p12\nquarkus.tls.my-tls.key-store.p12.password=${KEYSTORE_PASSWORD}","handlingStrategy":"validation","validationCode":"String password = System.getenv(\"KEYSTORE_PASSWORD\");\nif (password == null || password.isBlank()) {\n    throw new IllegalStateException(\"Set quarkus.tls.<name>.key-store.p12.password or configure a credential provider\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    // start app\n} catch (IllegalStateException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"key store password is not set\")) {\n        log.error(\"Provide quarkus.tls.<name>.key-store.p12.password or a working credential provider\");\n    }\n    throw e;\n}","preventionTips":["Always set the p12 password property (possibly via property expansion from an env var)","Verify credential provider name/group matches an actually registered provider","Add startup config validation in CI with the same profile used in prod","Check Kubernetes secret mounts actually inject the expected key"],"tags":["tls","keystore","p12","password","config"],"backgroundTag":"missing-keystore-password","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}