quarkusio/quarkus · error · IllegalArgumentException

Invalid JKS key store configuration for certificate '" + nam

Error message

Invalid JKS key store configuration for certificate '" + name + "' - the key store password is not set and cannot be retrieved from the credential provider.

What it means

When building Vert.x JksOptions for a key store, JKSKeyStores.toOptions asks CredentialProviders.getKeyStorePassword for the password (from config or a credentials provider). If neither yields a value, it throws this IllegalArgumentException because a JKS keystore cannot be opened without its password.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java:63

        verifyTrustStoreAlias(options, name, ks);
        if (config.certificateExpirationPolicy() == TrustStoreConfig.CertificateExpiryPolicy.IGNORE) {
            return new TrustStoreAndTrustOptions(ks, options);
        } else {
            var wrapped = new ExpiryTrustOptions(options, config.certificateExpirationPolicy());
            return new TrustStoreAndTrustOptions(ks, wrapped);
        }

    }

    private static JksOptions toOptions(JKSKeyStoreConfig config,
            KeyStoreCredentialProviderConfig keyStoreCredentialProviderConfig, String name) {
        JksOptions options = new JksOptions();
        try {
            options.setValue(Buffer.buffer(read(config.path())));
            String p = CredentialProviders.getKeyStorePassword(config.password(), keyStoreCredentialProviderConfig)
                    .orElse(null);
            if (p == null) {
                throw new IllegalArgumentException("Invalid JKS key store configuration for certificate '" + name
                        + "' - the key store password is not set and cannot be retrieved from the credential provider.");
            }
            options.setPassword(p);
            if (config.alias().isPresent()) {
                options.setAlias(config.alias().get());
            }
            String ap = CredentialProviders.getAliasPassword(config.aliasPassword(), keyStoreCredentialProviderConfig)
                    .orElse(null);
            options.setAliasPassword(ap);
            return options;
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid JKS key store configuration for certificate '" + name
                    + "' - cannot read the key store file '" + config.path() + "'", e);
        } catch (Exception e) {
            throw new IllegalStateException("Invalid JKS key store configuration for certificate '" + name + "'", e);
        }
    }

View on GitHub (pinned to e1c734241f)

Solutions

Set quarkus.tls.<name>.key-store.jks.password directly
Or configure credentials-provider.name and ensure the named provider returns the PASSWORD property
Verify the provider returns the password under the expected key (CredentialsProvider.PASSWORD_PROPERTY_NAME)
Confirm the JKS file actually requires/uses that password

Example fix

# before
quarkus.tls.my-tls.key-store.jks.path=keystore.jks
# after
quarkus.tls.my-tls.key-store.jks.path=keystore.jks
quarkus.tls.my-tls.key-store.jks.password=changeit

Defensive patterns

Strategy: validation

Validate before calling

boolean hasPassword = cfg.getOptionalValue("quarkus.tls.my-tls.key-store.jks.password", String.class).isPresent()
    || cfg.getOptionalValue("quarkus.tls.my-tls.key-store.jks.credentials-provider.name", String.class).isPresent();
if (!hasPassword) throw new IllegalStateException("JKS keystore needs a password or credentials provider");

Try / catch

try {
    Quarkus.run(args);
} catch (IllegalArgumentException e) {
    if (e.getMessage() != null && e.getMessage().contains("key store password is not set")) {
        log.error("Set jks.password or a working credentials provider");
    }
    throw e;
}

Prevention

Always pair jks.path with jks.password or credentials-provider config
Verify providers return the PASSWORD property
Test keystore password resolution in CI with a dummy JKS

When it happens

Trigger: quarkus.tls.<name>.key-store.jks.path set but neither jks.password nor a resolvable credentials-provider password is configured; the credentials provider returns no password property.

Common situations: Password intentionally stored in a secret manager but the provider lookup fails/returns empty; password property name mismatch (e.g. provider returns 'password' but code expects the standard key); config migration dropped the password key.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/604598f758e4f055. Report an issue: GitHub.