{"record":{"id":"8eff46812989c065","repo":"quarkusio/quarkus","slug":"failed-to-configure-default-webauthn-certificates","errorCode":null,"errorMessage":"Failed to configure default WebAuthn certificates","messagePattern":"Failed to configure default WebAuthn certificates","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/security-webauthn/runtime/src/main/java/io/quarkus/security/webauthn/WebAuthnSecurity.java","lineNumber":263,"sourceCode":"    private WebAuthnAsyncManager makeWebAuthn(Vertx vertx, WebAuthnRunTimeConfig config) {\n        if (config.attestation().isPresent()\n                && config.attestation().get() != WebAuthnRunTimeConfig.Attestation.NONE) {\n            TrustAnchorAsyncRepository something;\n            // FIXME: make config name configurable?\n            Optional<TlsConfiguration> webauthnTlsConfiguration = certificates.get(\"webauthn\");\n            KeyStore trustStore;\n            if (webauthnTlsConfiguration.isPresent()) {\n                trustStore = webauthnTlsConfiguration.get().getTrustStore();\n            } else {\n                try {\n                    trustStore = KeyStore.getInstance(KeyStore.getDefaultType());\n                    trustStore.load(null, null);\n                    addCert(trustStore, ANDROID_KEYSTORE_ROOT);\n                    addCert(trustStore, APPLE_WEBAUTHN_ROOT_CA);\n                    addCert(trustStore, FIDO_MDS3_ROOT_CERTIFICATE);\n                    addCert(trustStore, GSR1);\n                } catch (CertificateException | KeyStoreException | NoSuchAlgorithmException | IOException e) {\n                    throw new RuntimeException(\"Failed to configure default WebAuthn certificates\", e);\n                }\n            }\n            Set<TrustAnchor> trustAnchors = new HashSet<>();\n            try {\n                Enumeration<String> aliases = trustStore.aliases();\n                while (aliases.hasMoreElements()) {\n                    trustAnchors.add(new TrustAnchor((X509Certificate) trustStore.getCertificate(aliases.nextElement()), null));\n                }\n            } catch (KeyStoreException e) {\n                throw new RuntimeException(\"Failed to configure WebAuthn trust store\", e);\n            }\n            // FIXME CLRs are not supported yet\n            something = new KeyStoreTrustAnchorAsyncRepository(trustStore);\n            if (config.loadMetadata().orElse(false)) {\n                HttpAsyncClient httpClient = new VertxHttpAsyncClient(vertx);\n                FidoMDS3MetadataBLOBAsyncProvider blobAsyncProvider = new FidoMDS3MetadataBLOBAsyncProvider(objectConverter,\n                        FidoMDS3MetadataBLOBAsyncProvider.DEFAULT_BLOB_ENDPOINT, httpClient, trustAnchors);\n                something = new MetadataBLOBBasedTrustAnchorAsyncRepository(blobAsyncProvider);","sourceCodeStart":245,"sourceCodeEnd":281,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security-webauthn/runtime/src/main/java/io/quarkus/security/webauthn/WebAuthnSecurity.java#L245-L281","documentation":"During application startup, when WebAuthN attestation is not NONE and no dedicated 'webauthn' TLS registry trust store is configured, Quarkus builds a default trust store containing well-known attestation root certificates (Google Android Keystore, Apple WebAuthn root CA, FIDO MDS3 root, GSR1). If parsing or loading any of these embedded PEM certificates into the KeyStore fails, this RuntimeException is thrown with the underlying cause attached.","triggerScenarios":"quarkus.security.webauthn.attestation is set to DIRECT or INDIRECT (anything but NONE) during WebAuthnSecurity bean construction; one of the bundled root certificates fails to parse (CertificateException via JWS.parseX5c), the KeyStore refuses the entry (KeyStoreException), or the default KeyStore type cannot be initialized (NoSuchAlgorithmException/IOException).","commonSituations":"Enabling attestation verification in config; unusual JVM/crypto providers where KeyStore.getDefaultType() initialization fails; corrupted Quarkus build/runtime artifacts breaking embedded PEM resources; restricted environments where the default keystore type is unavailable.","solutions":["Check the 'Caused by' chain to see which certificate/keystore step failed and fix accordingly","If you do not need attestation verification, remove quarkus.security.webauthn.attestation (or set it to NONE) so the default trust store is never built","Configure your own trust store via the quarkus.tls.key-store/trust-store registry named 'webauthn' (quarkus.tls.webauthn.trust-store.*) instead of relying on the bundled defaults","Verify you are on an intact Quarkus build/JVM with standard JCE providers; try a standard JDK or restore default security properties"],"exampleFix":"// before (application.properties)\nquarkus.security.webauthn.attestation=direct\n// after - if attestation not needed\nquarkus.security.webauthn.attestation=none\n// or keep direct and supply your own trust store\nquarkus.tls.webauthn.trust-store.pem.a-certs.0=roots.pem","handlingStrategy":"validation","validationCode":"// application.properties check before enabling attestation\n// quarkus.security.webauthn.attestation=direct  -> requires trust material; prefer 'none' or supply quarkus.tls.webauthn.trust-store.*","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only enable attestation (non-NONE) when you actually verify attestation statements","Provide an explicit quarkus.tls.webauthn.trust-store rather than relying on bundled default certificates","Read the 'Caused by' chain; it names the failing certificate or keystore operation","Run on a standard JDK with default JCE providers"],"tags":["webauthn","keystore","startup","certificate"],"backgroundTag":"trust-store-initialization-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}