{"record":{"id":"ff80b2ef12c014d9","repo":"quarkusio/quarkus","slug":"invalid-trust-store-configuration-for-certificate-ff80b2","errorCode":null,"errorMessage":"Invalid trust store configuration for certificate '${name}' - cannot read the trust store file '${path}'","messagePattern":"Invalid trust store configuration for certificate '(.+?)' - cannot read the trust store file '(.+?)'","errorType":"exception","errorClass":"java.lang.IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java","lineNumber":118,"sourceCode":"            if (config.provider().isPresent()) {\n                options.setProvider(config.provider().get());\n            }\n            options.setValue(Buffer.buffer(data));\n            options.setPassword(password);\n            if (config.alias().isPresent()) {\n                options.setAlias(config.alias().get());\n            }\n\n            verifyTrustStoreAlias(config.alias(), name, ks);\n\n            if (tsc.certificateExpirationPolicy() == TrustStoreConfig.CertificateExpiryPolicy.IGNORE) {\n                return new TrustStoreAndTrustOptions(ks, options);\n            } else {\n                var wrapped = new ExpiryTrustOptions(options, tsc.certificateExpirationPolicy());\n                return new TrustStoreAndTrustOptions(ks, wrapped);\n            }\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid trust store configuration for certificate '\" + name\n                    + \"' - cannot read the trust store file '\" + config.path().get() + \"'\", e);\n        } catch (IllegalStateException | IllegalArgumentException e) {\n            throw e;\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid trust store configuration for certificate '\" + name + \"'\", e);\n        }\n    }\n\n    private static KeyStore getInstance(String type, Optional<String> provider) {\n        try {\n            if (provider.isPresent()) {\n                return KeyStore.getInstance(type, provider.get());\n            }\n            return KeyStore.getInstance(type);\n        } catch (KeyStoreException | NoSuchProviderException e) {\n            throw new IllegalStateException(\"Unable to create key store of type '\" + type + \"'\"\n                    + (provider.isPresent() ? \" with provider '\" + provider.get() + \"'\" : \"\"), e);\n        }","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java#L100-L136","documentation":"Thrown by OtherKeyStores.verifyOtherTrustStore when reading the configured trust store file fails with an UncheckedIOException: the path is configured but its bytes cannot be loaded (missing file, unreadable permissions, I/O error). The wrapper names the certificate configuration and the failing path and keeps the original IO exception as cause.","triggerScenarios":"read(config.path().get()) throws UncheckedIOException — file missing, unreadable, bad mount.","commonSituations":"CA bundle path typo; configmap/secret not mounted; working-directory difference.","solutions":["Fix quarkus.tls.trust-store-other.path","Ensure the file exists in the image/container","Check permissions"],"exampleFix":"# before\nquarkus.tls.trust-store-other.path=/etc/ca.pem\n# after\nquarkus.tls.trust-store-other.path=/etc/pki/ca-bundle.pem\n","handlingStrategy":"validation","validationCode":"if (!java.nio.file.Files.isReadable(java.nio.file.Path.of(path))) throw new IllegalStateException(\"Trust store unreadable: \" + path);\n","typeGuard":null,"tryCatchPattern":"try { init(); } catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"cannot read the trust store file\")) { log.error(\"Missing trust store: \" + path, e.getCause()); }\n    throw e;\n}","preventionTips":["Verify CA bundle path in each environment","Ensure configmap/secret mounted before startup"],"tags":["tls","truststore","io","file-not-found"],"backgroundTag":"file-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}