{"record":{"id":"c9c552c44fb5f102","repo":"quarkusio/quarkus","slug":"invalid-trust-store-configuration-for-certificate","errorCode":null,"errorMessage":"Invalid trust store configuration for certificate '${name}' - no path specified and no TrustStoreFactory found for type '${type}'","messagePattern":"Invalid trust store configuration for certificate '(.+?)' - no path specified and no TrustStoreFactory found for type '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java","lineNumber":82,"sourceCode":"            options.setAliasPassword(aliasPassword);\n\n            verifyKeyStoreAlias(config, name, ks, aliasPassword);\n            return new KeyStoreAndKeyCertOptions(ks, options);\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid key store configuration for certificate '\" + name\n                    + \"' - cannot read the key store file '\" + config.path().get() + \"'\", e);\n        } catch (IllegalStateException | IllegalArgumentException e) {\n            throw e;\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid key store configuration for certificate '\" + name + \"'\", e);\n        }\n    }\n\n    public static TrustStoreAndTrustOptions verifyOtherTrustStore(TrustStoreConfig tsc, String name) {\n        OtherTrustStoreConfig config = tsc.other().orElseThrow();\n\n        if (config.path().isEmpty()) {\n            throw new IllegalStateException(\"Invalid trust store configuration for certificate '\" + name\n                    + \"' - no path specified and no TrustStoreFactory found for type '\" + config.type() + \"'\");\n        }\n\n        try {\n            byte[] data = read(config.path().get());\n            String password = CredentialProviders.getTrustStorePassword(config.password(), tsc.credentialsProvider())\n                    .orElse(null);\n            if (password == null) {\n                throw new IllegalStateException(\"Invalid trust store configuration for certificate '\" + name\n                        + \"' - the trust store password is not set and cannot be retrieved from the credential provider.\");\n            }\n\n            KeyStore ks = getInstance(config.type(), config.provider());\n            ks.load(new ByteArrayInputStream(data), password.toCharArray());\n\n            KeyStoreOptions options = new KeyStoreOptions();\n            options.setType(config.type());\n            if (config.provider().isPresent()) {","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java#L64-L100","documentation":"Thrown by OtherKeyStores.verifyOtherTrustStore when a non-PKCS12/JKS trust store configuration provides neither a path nor a registered TrustStoreFactory for the configured type. Trust stores of 'other' types must come from a readable file or from an in-memory TrustStoreFactory contributed by an extension; with both absent there is no source of certificates to trust, so the startup-time guard fires naming the certificate configuration and store type.","triggerScenarios":"verifyOtherTrustStore: quarkus.tls.trust-store-other.type set without path and no TrustStoreFactory registered for that type.","commonSituations":"Using a custom trust store type requiring an extension that isn't a dependency; forgetting the path.","solutions":["Set quarkus.tls.trust-store-other.path","Add the extension providing the TrustStoreFactory","Correct the type name"],"exampleFix":"# before\nquarkus.tls.trust-store-other.type=custom\n# after\nquarkus.tls.trust-store-other.type=custom\nquarkus.tls.trust-store-other.path=certs/trust.custom\n","handlingStrategy":"validation","validationCode":"if (config.path().isEmpty()) throw new IllegalArgumentException(\"trust-store-other.path is required\");\n","typeGuard":null,"tryCatchPattern":"try { init(); } catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"Invalid trust store\")) { log.error(\"Set trust-store-other.path or add TrustStoreFactory\"); }\n    throw e;\n}","preventionTips":["Set path explicitly","Only use custom types with the providing extension on classpath"],"tags":["tls","truststore","configuration"],"backgroundTag":"incomplete-tls-config","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}