{"record":{"id":"f0a7b614e4e2740f","repo":"quarkusio/quarkus","slug":"invalid-p12-key-store-configuration-for-certificat-f0a7b6","errorCode":null,"errorMessage":"Invalid P12 key store configuration for certificate '${name}'","messagePattern":"Invalid P12 key store configuration for certificate '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java","lineNumber":74,"sourceCode":"        try {\n            options.setValue(Buffer.buffer(read(config.path())));\n            String password = CredentialProviders.getKeyStorePassword(config.password(), pc)\n                    .orElse(null);\n            if (password == null) {\n                throw new IllegalStateException(\"Invalid P12 key store configuration for certificate '\" + name\n                        + \"' - the key store password is not set and cannot be retrieved from the credential provider.\");\n            }\n            options.setPassword(password);\n            if (config.alias().isPresent()) {\n                options.setAlias(config.alias().get());\n            }\n            String ap = CredentialProviders.getAliasPassword(config.aliasPassword(), pc).orElse(null);\n            options.setAliasPassword(ap);\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid P12 key store configuration for certificate '\" + name\n                    + \"' - cannot read the key store file '\" + config.path() + \"'\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid P12 key store configuration for certificate '\" + name + \"'\", e);\n        }\n        return options;\n    }\n\n    private static PfxOptions toOptions(P12TrustStoreConfig config, TrustStoreCredentialProviderConfig cp, String name) {\n        PfxOptions options = new PfxOptions();\n        try {\n            options.setValue(Buffer.buffer(read(config.path())));\n            String password = CredentialProviders.getTrustStorePassword(config.password(), cp)\n                    .orElse(null);\n            if (password == null) {\n                throw new IllegalStateException(\"Invalid P12 trust store configuration for certificate '\" + name\n                        + \"' - the trust store password is not set and cannot be retrieved from the credential provider.\");\n            }\n            options.setPassword(password);\n            if (config.alias().isPresent()) {\n                options.setAlias(config.alias().get());\n            }","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java#L56-L92","documentation":"A generic catch-all in P12KeyStores.toOptions: any exception while assembling the PfxOptions for the P12 key store (that is not the password or file-read cases) is wrapped into this IllegalStateException naming the certificate. The original cause is attached and must be inspected to know what failed.","triggerScenarios":"Any Exception thrown inside toOptions after the file read — e.g. failures resolving alias/alias-password through the credential provider, buffer/encoding errors, or provider issues — not covered by the UncheckedIOException branch.","commonSituations":"Credential provider throwing while fetching the alias password; malformed path expression causing unexpected runtime exception; Vert.x buffer creation failure on odd file content; bugs/regressions in extension versions.","solutions":["Read the caused-by chain of the IllegalStateException for the root cause","If it involves credential providers, verify the provider configuration and that the referenced secret exists","Re-export the P12 file with standard tooling (keytool) in case the file content is malformed","Update/check the Quarkus and Vert.x versions for known regressions; reproduce with a minimal config"],"exampleFix":"// before: provider referenced but not configured\nquarkus.tls.my-tls.key-store.credential-provider.name=no-such-provider\n// after\nquarkus.tls.my-tls.key-store.credential-provider.name=keycloak-credentials-provider","handlingStrategy":"try-catch","validationCode":"// Ensure config is complete before starting:\nObjects.requireNonNull(cfg.path(), \"p12 path required\");\nObjects.requireNonNull(cfg.password().orElse(providerPassword), \"p12 password required\");","typeGuard":null,"tryCatchPattern":"try {\n    // init TLS\n} catch (IllegalStateException e) {\n    if (e.getMessage() != null && e.getMessage().equals(\"Invalid P12 key store configuration for certificate 'my-cert'\")) {\n        log.error(\"Inspect cause for root failure\", e.getCause());\n    }\n    throw e;\n}","preventionTips":["Always read the caused-by chain — this message is generic by design","Keep credential provider config minimal and tested","Validate generated P12 files with keytool -list after every regeneration","Pin and test Quarkus/Vert.x versions used with custom credential providers"],"tags":["tls","keystore","p12","config","startup"],"backgroundTag":"keystore-load-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}