{"record":{"id":"8d335917e81c36b0","repo":"quarkusio/quarkus","slug":"invalid-p12-trust-store-configuration-for-certific-8d3359","errorCode":null,"errorMessage":"Invalid P12 trust store configuration for certificate '${name}' - cannot read the trust store file '${path}'","messagePattern":"Invalid P12 trust store configuration for certificate '(.+?)' - cannot read the trust store file '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java","lineNumber":94,"sourceCode":"        return options;\n    }\n\n    private static PfxOptions toOptions(P12TrustStoreConfig config, TrustStoreCredentialProviderConfig cp, String name) {\n        PfxOptions options = new PfxOptions();\n        try {\n            options.setValue(Buffer.buffer(read(config.path())));\n            String password = CredentialProviders.getTrustStorePassword(config.password(), cp)\n                    .orElse(null);\n            if (password == null) {\n                throw new IllegalStateException(\"Invalid P12 trust store configuration for certificate '\" + name\n                        + \"' - the trust store password is not set and cannot be retrieved from the credential provider.\");\n            }\n            options.setPassword(password);\n            if (config.alias().isPresent()) {\n                options.setAlias(config.alias().get());\n            }\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid P12 trust store configuration for certificate '\" + name\n                    + \"' - cannot read the trust store file '\" + config.path() + \"'\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid P12 trust store configuration for certificate '\" + name + \"'\", e);\n        }\n        return options;\n    }\n\n    private static void verifyKeyStoreAlias(PfxOptions options, String name,\n            KeyStore ks) {\n        String alias = options.getAlias();\n        String aliasPassword = options.getAliasPassword();\n        if (alias != null) {\n            try {\n                if (ks.getCertificate(alias) == null) {\n                    throw new IllegalStateException(\n                            \"Alias '\" + alias + \"' not found in P12 key store (certificate not found)'\" + name + \"'\");\n                }\n            } catch (KeyStoreException e) {","sourceCodeStart":76,"sourceCodeEnd":112,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java#L76-L112","documentation":"Quarkus reads the P12 trust store file into memory when constructing PfxOptions. If that read fails with an UncheckedIOException, the error is wrapped in an IllegalStateException stating the trust store file could not be read.","triggerScenarios":"P12TrustStoreConfig.path() points to a nonexistent, unreadable, or invalid path; read() throws UncheckedIOException during toOptions for the named certificate's trust store.","commonSituations":"Wrong relative path (file outside the working directory), file not packaged in the container/native image, typo in quarkus.tls.<name>.trust-store.p12.path, permissions issue after containerization.","solutions":["Verify the path exists and is readable at runtime; use a classpath:/... or absolute path","Ensure the .p12 file is included in the build (src/main/resources or container image layer)","Correct the quarkus.tls.<name>.trust-store.p12.path value","Check file permissions for the runtime user"],"exampleFix":"// before\nquarkus.tls.my-cert.trust-store.p12.path=./truststore.p12\n// after\nquarkus.tls.my-cert.trust-store.p12.path=classpath:certs/truststore.p12","handlingStrategy":"validation","validationCode":"Path p = Path.of(configuredPath);\nif (!Files.isReadable(p)) {\n    throw new IllegalArgumentException(\"Trust store not readable: \" + p.toAbsolutePath());\n}","typeGuard":null,"tryCatchPattern":"try {\n    tlsRegistry.get(\"my-cert\");\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"cannot read the trust store file\")) {\n        log.error(\"Check trust-store.p12.path; caused by: \", e.getCause());\n    }\n}","preventionTips":["Use classpath:/ paths for resources packaged in the artifact","Verify container/native-image builds include the .p12 file","Use absolute paths when files live outside the app working directory","Add a startup smoke test that loads every configured TLS bundle"],"tags":["quarkus","tls","p12","truststore","io"],"backgroundTag":"keystore-file-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}