quarkusio/quarkus · error · IllegalStateException

Invalid JKS trust store configuration for certificate '" + n

Error message

Invalid JKS trust store configuration for certificate '" + name + "' - the trust store password is not set and cannot be retrieved from the credential provider.

What it means

JKSKeyStores.toOptions for trust stores resolves the trust store password via CredentialProviders.getTrustStorePassword; JKS trust stores require a password, so when neither config nor a credentials provider yields one, this IllegalStateException is thrown.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/JKSKeyStores.java:90

            options.setAliasPassword(ap);
            return options;
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid JKS key store configuration for certificate '" + name
                    + "' - cannot read the key store file '" + config.path() + "'", e);
        } catch (Exception e) {
            throw new IllegalStateException("Invalid JKS key store configuration for certificate '" + name + "'", e);
        }
    }

    private static JksOptions toOptions(JKSTrustStoreConfig config,
            TrustStoreCredentialProviderConfig trustStoreCredentialProviderConfig, String name) {
        JksOptions options = new JksOptions();
        try {
            options.setValue(Buffer.buffer(read(config.path())));
            String password = CredentialProviders.getTrustStorePassword(config.password(), trustStoreCredentialProviderConfig)
                    .orElse(null);
            if (password == null) {
                throw new IllegalStateException("Invalid JKS trust store configuration for certificate '" + name
                        + "' - the trust store password is not set and cannot be retrieved from the credential provider.");
            }
            options.setPassword(password);
            if (config.alias().isPresent()) {
                options.setAlias(config.alias().get());
            }
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid JKS trust store configuration for certificate '" + name
                    + "' - cannot read the trust store file '" + config.path() + "'", e);
        } catch (Exception e) {
            throw new IllegalStateException("Invalid JKS trust store configuration for certificate '" + name + "'", e);
        }
        return options;
    }

    private static void verifyKeyStoreAlias(JksOptions options, String name, KeyStore ks) {
        String alias = options.getAlias();
        // Credential provider already called.

View on GitHub (pinned to e1c734241f)

Solutions

Set quarkus.tls.<name>.trust-store.jks.password directly
Or configure trust-store.jks.credentials-provider.name and ensure that provider returns the password
Verify the provider maps the password to the expected property name
Convert the truststore to PKCS12 if a passwordless/integrity-only setup is acceptable

Example fix

# before
quarkus.tls.my-tls.trust-store.jks.path=truststore.jks
# after
quarkus.tls.my-tls.trust-store.jks.path=truststore.jks
quarkus.tls.my-tls.trust-store.jks.password=changeit

Defensive patterns

Strategy: validation

Validate before calling

boolean hasPassword = cfg.getOptionalValue("quarkus.tls.my-tls.trust-store.jks.password", String.class).isPresent()
    || cfg.getOptionalValue("quarkus.tls.my-tls.trust-store.jks.credentials-provider.name", String.class).isPresent();
if (!hasPassword) throw new IllegalStateException("JKS truststore needs a password or credentials provider");

Prevention

Always set trust-store.jks.password or a credentials provider
Remember JKS trust stores need passwords unlike PEM/PKCS12 defaults
Verify secret-manager providers return non-empty passwords

When it happens

Trigger: quarkus.tls.<name>.trust-store.jks.path set but neither trust-store.jks.password nor a resolvable credentials-provider trust-store password is configured.

Common situations: Assuming JKS trust stores are passwordless (PKCS12/PEM often don't need one); secret manager returning empty credentials; password lost during config migration between Quarkus versions.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/14b6551af3b73f22. Report an issue: GitHub.