{"record":{"id":"ea406e1ab07732c6","repo":"quarkusio/quarkus","slug":"invalid-truststore-name-the-truststore","errorCode":null,"errorMessage":"Invalid truststore '\" + name + \"' - The truststore cannot be configured with a provider and PEM, PKCS12, JKS, or other at the same time","messagePattern":"Invalid truststore '\" \\+ name \\+ \"' - The truststore cannot be configured with a provider and PEM, PKCS12, JKS, or other at the same time","errorType":"validation","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/TrustStoreConfig.java","lineNumber":83,"sourceCode":"     * The credential provider configuration for the trust store.\n     * A credential provider offers a way to retrieve the trust store password.\n     * Note that the credential provider is only used if the password is not set in the configuration.\n     */\n    TrustStoreCredentialProviderConfig credentialsProvider();\n\n    default void validate(InstanceHandle<TrustStoreProvider> provider, String name) {\n        int count = 0;\n        if (pem().isPresent())\n            count++;\n        if (p12().isPresent())\n            count++;\n        if (jks().isPresent())\n            count++;\n        if (other().isPresent())\n            count++;\n\n        if (provider.isAvailable() && count > 0) {\n            throw new IllegalStateException(\n                    \"Invalid truststore '\" + name\n                            + \"' - The truststore cannot be configured with a provider and PEM, PKCS12, JKS, or other at the same time\");\n        }\n\n        if (count > 1) {\n            throw new IllegalStateException(\n                    \"Invalid truststore '\" + name\n                            + \"' - Only one truststore type can be configured at a time (PEM, PKCS12, JKS, or other)\");\n        }\n    }\n\n}\n","sourceCodeStart":65,"sourceCodeEnd":96,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/TrustStoreConfig.java#L65-L96","documentation":"TrustStoreConfig.validate enforces that a truststore is configured exclusively through the 'provider' mechanism or through concrete store types (PEM/PKCS12/JKS/other), never both. When a credentials provider is available AND at least one of the store types is also configured, this IllegalStateException is thrown at configuration startup.","triggerScenarios":"Setting both quarkus.tls.<name>.trust-store.provider.* (credentials provider config making provider available) and any of trust-store.pem / trust-store.p12 / trust-store.jks / trust-store.other in the same named TLS config.","commonSituations":"Migrating from file-based truststore to a provider-supplied one and leaving the old pem/jks entries behind; copy-pasting a TLS config template that mixes both styles.","solutions":["Remove the trust-store.pem/p12/jks/other entries and keep only provider config","Or remove the provider.* config and use the explicit store type only","Run the app with dev mode config report to see the full effective trust-store tree and prune duplicates"],"exampleFix":"# before\nquarkus.tls.my-tls.trust-store.jks.path=trust.jks\nquarkus.tls.my-tls.trust-store.jks.password=pw\nquarkus.tls.my-tls.trust-store.provider.name=main\n# after\nquarkus.tls.my-tls.trust-store.jks.path=trust.jks\nquarkus.tls.my-tls.trust-store.jks.password=pw","handlingStrategy":"validation","validationCode":"// Ensure only one truststore mechanism is configured\nboolean hasProvider = cfg.getOptionalValue(\"quarkus.tls.my-tls.trust-store.provider.name\", String.class).isPresent();\nboolean hasStore = Stream.of(\"pem\", \"p12\", \"jks\", \"other\")\n    .anyMatch(t -> !cfg.getPropertyNames(\"quarkus.tls.my-tls.trust-store.\" + t).isEmpty());\nif (hasProvider && hasStore) throw new IllegalStateException(\"Use provider XOR explicit store type\");","typeGuard":null,"tryCatchPattern":"try {\n    Quarkus.run(args);\n} catch (IllegalStateException e) {\n    if (e.getMessage().startsWith(\"Invalid truststore\")) {\n        log.errorf(\"Fix truststore config: %s\", e.getMessage());\n    }\n    throw e;\n}","preventionTips":["Configure each truststore with exactly one mechanism","Remove legacy entries when migrating to credential providers","Review effective config in dev mode before deploying"],"tags":["tls","truststore","config-validation"],"backgroundTag":"conflicting-tls-config","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}