{"record":{"id":"ce41fb3ed1d6d503","repo":"quarkusio/quarkus","slug":"invalid-truststore-name-only-one-trust","errorCode":null,"errorMessage":"Invalid truststore '\" + name + \"' - Only one truststore type can be configured at a time (PEM, PKCS12, JKS, or other)","messagePattern":"Invalid truststore '\" \\+ name \\+ \"' - Only one truststore type can be configured at a time \\(PEM, PKCS12, JKS, or other\\)","errorType":"validation","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/TrustStoreConfig.java","lineNumber":89,"sourceCode":"    default void validate(InstanceHandle<TrustStoreProvider> provider, String name) {\n        int count = 0;\n        if (pem().isPresent())\n            count++;\n        if (p12().isPresent())\n            count++;\n        if (jks().isPresent())\n            count++;\n        if (other().isPresent())\n            count++;\n\n        if (provider.isAvailable() && count > 0) {\n            throw new IllegalStateException(\n                    \"Invalid truststore '\" + name\n                            + \"' - The truststore cannot be configured with a provider and PEM, PKCS12, JKS, or other at the same time\");\n        }\n\n        if (count > 1) {\n            throw new IllegalStateException(\n                    \"Invalid truststore '\" + name\n                            + \"' - Only one truststore type can be configured at a time (PEM, PKCS12, JKS, or other)\");\n        }\n    }\n\n}\n","sourceCodeStart":71,"sourceCodeEnd":96,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/TrustStoreConfig.java#L71-L96","documentation":"TrustStoreConfig.validate counts how many of the truststore types (PEM, PKCS12, JKS, other) are configured. More than one being present is ambiguous, so validate throws this IllegalStateException at startup.","triggerScenarios":"Configuring two or more of trust-store.pem, trust-store.p12, trust-store.jks, trust-store.other for the same named TLS config (or the default).","commonSituations":"Adding a PEM cert list while a legacy JKS truststore entry remains; environment variable profiles (e.g. %prod) merging with default values so two types end up set at once.","solutions":["Keep exactly one truststore type; delete the others","Check %profile-scoped properties that may inject a second type","Use multiple named TLS bucket configs instead of mixing types in one"],"exampleFix":"# before\nquarkus.tls.my-tls.trust-store.jks.path=trust.jks\nquarkus.tls.my-tls.trust-store.pem.0.cert=ca.pem\n# after\nquarkus.tls.my-tls.trust-store.pem.0.cert=ca.pem","handlingStrategy":"validation","validationCode":"long types = Stream.of(\"pem\", \"p12\", \"jks\", \"other\")\n    .filter(t -> !cfg.getPropertyNames(\"quarkus.tls.my-tls.trust-store.\" + t).isEmpty())\n    .count();\nif (types > 1) throw new IllegalStateException(\"Configure only one truststore type\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep one truststore type per named TLS bucket","Audit %-profile overrides that can merge a second type","Use separate named TLS configs for different stores"],"tags":["tls","truststore","config-validation"],"backgroundTag":"conflicting-tls-config","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}