quarkusio/quarkus · error · RuntimeException

Failed to configure WebAuthn trust store

Error message

Failed to configure WebAuthn trust store

What it means

After building (or loading from TLS config) the WebAuthn trust store, Quarkus iterates its aliases to construct TrustAnchor objects for certificate-path verification of attestation statements. If KeyStore.aliases() or getCertificate() fails (typically because the keystore is not loaded), this RuntimeException wraps the KeyStoreException.

Source

Thrown at extensions/security-webauthn/runtime/src/main/java/io/quarkus/security/webauthn/WebAuthnSecurity.java:273

                try {
                    trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
                    trustStore.load(null, null);
                    addCert(trustStore, ANDROID_KEYSTORE_ROOT);
                    addCert(trustStore, APPLE_WEBAUTHN_ROOT_CA);
                    addCert(trustStore, FIDO_MDS3_ROOT_CERTIFICATE);
                    addCert(trustStore, GSR1);
                } catch (CertificateException | KeyStoreException | NoSuchAlgorithmException | IOException e) {
                    throw new RuntimeException("Failed to configure default WebAuthn certificates", e);
                }
            }
            Set<TrustAnchor> trustAnchors = new HashSet<>();
            try {
                Enumeration<String> aliases = trustStore.aliases();
                while (aliases.hasMoreElements()) {
                    trustAnchors.add(new TrustAnchor((X509Certificate) trustStore.getCertificate(aliases.nextElement()), null));
                }
            } catch (KeyStoreException e) {
                throw new RuntimeException("Failed to configure WebAuthn trust store", e);
            }
            // FIXME CLRs are not supported yet
            something = new KeyStoreTrustAnchorAsyncRepository(trustStore);
            if (config.loadMetadata().orElse(false)) {
                HttpAsyncClient httpClient = new VertxHttpAsyncClient(vertx);
                FidoMDS3MetadataBLOBAsyncProvider blobAsyncProvider = new FidoMDS3MetadataBLOBAsyncProvider(objectConverter,
                        FidoMDS3MetadataBLOBAsyncProvider.DEFAULT_BLOB_ENDPOINT, httpClient, trustAnchors);
                something = new MetadataBLOBBasedTrustAnchorAsyncRepository(blobAsyncProvider);
            }

            return new WebAuthnAsyncManager(
                    Arrays.asList(
                            new FIDOU2FAttestationStatementAsyncVerifier(),
                            new PackedAttestationStatementAsyncVerifier(),
                            new TPMAttestationStatementAsyncVerifier(),
                            new AndroidKeyAttestationStatementAsyncVerifier(),
                            new AndroidSafetyNetAttestationStatementAsyncVerifier(),
                            new AppleAnonymousAttestationStatementAsyncVerifier()),

View on GitHub (pinned to e1c734241f)

Solutions

1. Inspect the KeyStoreException cause; verify the trust store file exists, is readable, and the password is correct in quarkus.tls.webauthn.trust-store.*
2. Open the keystore with keytool -list to confirm it is valid and contains X509 certificate entries
3. Remove the custom 'webauthn' TLS registry config to fall back to the built-in default certificates
4. If attestation verification is unnecessary, set quarkus.security.webauthn.attestation=none

Example fix

// before
quarkus.tls.webauthn.trust-store.jks.path=/etc/certs/truststore.jks
quarkus.tls.webauthn.trust-store.jks.password=wrongpass
// after
quarkus.tls.webauthn.trust-store.jks.path=/etc/certs/truststore.jks
quarkus.tls.webauthn.trust-store.jks.password=correctpass

// validate the keystore before startup:
// keytool -list -keystore truststore.jks -storepass <pass>
// must succeed and contain X509 entries

When it happens

Trigger: quarkus.security.webauthn.attestation is DIRECT/INDIRECT and makeWebAuthn enumerates trustStore.aliases(); the configured quarkus.tls.webauthn trust store failed to load properly, is unreadable, or the JKS/PKCS12 was not initialized before enumeration.

Common situations: A 'webauthn' TLS registry trust store configured with a wrong password or path; a trust store file that is empty or corrupted; keystore type mismatch (JKS vs PKCS12); file permissions preventing the read at startup.

Related errors

• Failed to configure default WebAuthn certificates
• Unable to verify alias '${alias}' in trust store '${name}'
• Alias '${alias}' not found in key store (certificate not fou
• Unable to verify alias '${alias}' in key store '${name}'
• Invalid P12 key store configuration for certificate '${name}

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/60181df044f63744. Report an issue: GitHub.