{"record":{"id":"90114d06b2026f3b","repo":"quarkusio/quarkus","slug":"invalid-key-store-configuration-for-certificate","errorCode":null,"errorMessage":"Invalid key store configuration for certificate '${name}' - no path specified and no KeyStoreFactory found for type '${type}'","messagePattern":"Invalid key store configuration for certificate '(.+?)' - no path specified and no KeyStoreFactory found for type '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java","lineNumber":36,"sourceCode":"import io.quarkus.tls.runtime.config.OtherTrustStoreConfig;\nimport io.quarkus.tls.runtime.config.TrustStoreConfig;\nimport io.vertx.core.buffer.Buffer;\nimport io.vertx.core.net.KeyStoreOptions;\n\n/**\n * A utility class to load key stores and trust stores with arbitrary types.\n */\npublic class OtherKeyStores {\n\n    private OtherKeyStores() {\n        // Avoid direct instantiation\n    }\n\n    public static KeyStoreAndKeyCertOptions verifyOtherKeyStore(KeyStoreConfig ksc, String name) {\n        OtherKeyStoreConfig config = ksc.other().orElseThrow();\n\n        if (config.path().isEmpty()) {\n            throw new IllegalStateException(\"Invalid key store configuration for certificate '\" + name\n                    + \"' - no path specified and no KeyStoreFactory found for type '\" + config.type() + \"'\");\n        }\n\n        try {\n            byte[] data = read(config.path().get());\n            String password = CredentialProviders.getKeyStorePassword(config.password(), ksc.credentialsProvider())\n                    .orElse(null);\n            if (password == null) {\n                throw new IllegalStateException(\"Invalid key store configuration for certificate '\" + name\n                        + \"' - the key store password is not set and cannot be retrieved from the credential provider.\");\n            }\n\n            KeyStore ks = getInstance(config.type(), config.provider());\n            ks.load(new ByteArrayInputStream(data), password.toCharArray());\n\n            KeyStoreOptions options = new KeyStoreOptions();\n            options.setType(config.type());\n            if (config.provider().isPresent()) {","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java#L18-L54","documentation":"Thrown by OtherKeyStores.verifyOtherKeyStore when a non-PKCS12/JKS key store configuration has neither a file path nor a registered KeyStoreFactory for its type. The TLS registry resolves 'other' key stores either from a path on disk or in-memory via a KeyStoreFactory contributed by an extension; an empty path plus no factory for the configured type means there is no source for the store, so the configuration guard aborts at startup naming the certificate configuration and type.","triggerScenarios":"quarkus.tls.key-store.other.type set (e.g. PEM/custom) but quarkus.tls.key-store.other.path omitted and no io.quarkus.tls.runtime.keystores.KeyStoreFactory registered for that type.","commonSituations":"Copy-pasting a config block that relies on a custom factory without adding the extension providing it; forgetting the path property.","solutions":["Set quarkus.tls.key-store.other.path to the store file","Add the extension/provider that registers a KeyStoreFactory for the configured type","Verify the type value is spelled correctly"],"exampleFix":"# before\nquarkus.tls.key-store.other.type=custom\n# after\nquarkus.tls.key-store.other.type=custom\nquarkus.tls.key-store.other.path=certs/store.custom\n","handlingStrategy":"validation","validationCode":"if (config.path().isEmpty() && config.type() != null) {\n    throw new IllegalArgumentException(\"Provide quarkus.tls.key-store-other.path or register a KeyStoreFactory for \" + config.type());\n}\n","typeGuard":null,"tryCatchPattern":"try { buildTlsConfig(); } catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"no path specified\")) { log.error(\"key-store.other requires a path or factory\"); }\n    throw e;\n}","preventionTips":["Always set path for 'other' type unless you own a KeyStoreFactory","Prefer built-in jks/p12/pem options"],"tags":["tls","keystore","configuration"],"backgroundTag":"incomplete-tls-config","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}