quarkusio/quarkus · error · RuntimeException

Failed to configure default WebAuthn certificates

Error message

Failed to configure default WebAuthn certificates

What it means

During application startup, when WebAuthN attestation is not NONE and no dedicated 'webauthn' TLS registry trust store is configured, Quarkus builds a default trust store containing well-known attestation root certificates (Google Android Keystore, Apple WebAuthn root CA, FIDO MDS3 root, GSR1). If parsing or loading any of these embedded PEM certificates into the KeyStore fails, this RuntimeException is thrown with the underlying cause attached.

Source

Thrown at extensions/security-webauthn/runtime/src/main/java/io/quarkus/security/webauthn/WebAuthnSecurity.java:263

    private WebAuthnAsyncManager makeWebAuthn(Vertx vertx, WebAuthnRunTimeConfig config) {
        if (config.attestation().isPresent()
                && config.attestation().get() != WebAuthnRunTimeConfig.Attestation.NONE) {
            TrustAnchorAsyncRepository something;
            // FIXME: make config name configurable?
            Optional<TlsConfiguration> webauthnTlsConfiguration = certificates.get("webauthn");
            KeyStore trustStore;
            if (webauthnTlsConfiguration.isPresent()) {
                trustStore = webauthnTlsConfiguration.get().getTrustStore();
            } else {
                try {
                    trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
                    trustStore.load(null, null);
                    addCert(trustStore, ANDROID_KEYSTORE_ROOT);
                    addCert(trustStore, APPLE_WEBAUTHN_ROOT_CA);
                    addCert(trustStore, FIDO_MDS3_ROOT_CERTIFICATE);
                    addCert(trustStore, GSR1);
                } catch (CertificateException | KeyStoreException | NoSuchAlgorithmException | IOException e) {
                    throw new RuntimeException("Failed to configure default WebAuthn certificates", e);
                }
            }
            Set<TrustAnchor> trustAnchors = new HashSet<>();
            try {
                Enumeration<String> aliases = trustStore.aliases();
                while (aliases.hasMoreElements()) {
                    trustAnchors.add(new TrustAnchor((X509Certificate) trustStore.getCertificate(aliases.nextElement()), null));
                }
            } catch (KeyStoreException e) {
                throw new RuntimeException("Failed to configure WebAuthn trust store", e);
            }
            // FIXME CLRs are not supported yet
            something = new KeyStoreTrustAnchorAsyncRepository(trustStore);
            if (config.loadMetadata().orElse(false)) {
                HttpAsyncClient httpClient = new VertxHttpAsyncClient(vertx);
                FidoMDS3MetadataBLOBAsyncProvider blobAsyncProvider = new FidoMDS3MetadataBLOBAsyncProvider(objectConverter,
                        FidoMDS3MetadataBLOBAsyncProvider.DEFAULT_BLOB_ENDPOINT, httpClient, trustAnchors);
                something = new MetadataBLOBBasedTrustAnchorAsyncRepository(blobAsyncProvider);

View on GitHub (pinned to e1c734241f)

Solutions

1. Check the 'Caused by' chain to see which certificate/keystore step failed and fix accordingly
2. If you do not need attestation verification, remove quarkus.security.webauthn.attestation (or set it to NONE) so the default trust store is never built
3. Configure your own trust store via the quarkus.tls.key-store/trust-store registry named 'webauthn' (quarkus.tls.webauthn.trust-store.*) instead of relying on the bundled defaults
4. Verify you are on an intact Quarkus build/JVM with standard JCE providers; try a standard JDK or restore default security properties

Example fix

// before (application.properties)
quarkus.security.webauthn.attestation=direct
// after - if attestation not needed
quarkus.security.webauthn.attestation=none
// or keep direct and supply your own trust store
quarkus.tls.webauthn.trust-store.pem.a-certs.0=roots.pem

// application.properties check before enabling attestation
// quarkus.security.webauthn.attestation=direct  -> requires trust material; prefer 'none' or supply quarkus.tls.webauthn.trust-store.*

When it happens

Trigger: quarkus.security.webauthn.attestation is set to DIRECT or INDIRECT (anything but NONE) during WebAuthnSecurity bean construction; one of the bundled root certificates fails to parse (CertificateException via JWS.parseX5c), the KeyStore refuses the entry (KeyStoreException), or the default KeyStore type cannot be initialized (NoSuchAlgorithmException/IOException).

Common situations: Enabling attestation verification in config; unusual JVM/crypto providers where KeyStore.getDefaultType() initialization fails; corrupted Quarkus build/runtime artifacts breaking embedded PEM resources; restricted environments where the default keystore type is unavailable.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Failed to configure WebAuthn trust store
• No certificate found with alias: <alias>
• Alias '${alias}' not found in key store (certificate not fou
• Unable to verify alias '${alias}' in key store '${name}'
• Unable to verify alias '${alias}' in trust store '${name}'

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/8eff46812989c065. Report an issue: GitHub.