quarkusio/quarkus · error · java.lang.IllegalStateException

Invalid key store configuration for certificate '${name}' -

Error message

Invalid key store configuration for certificate '${name}' - the key store password is not set and cannot be retrieved from the credential provider.

What it means

Thrown by OtherKeyStores.verifyOtherKeyStore when the 'other' key store's password is neither set in configuration nor obtainable from the configured credentials provider. Loading the store requires its password up front; the credential-provider lookup (ksc.credentialsProvider()) returned empty and no explicit password exists, so the guard aborts startup naming the certificate configuration before any file is read.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java:45

    private OtherKeyStores() {
        // Avoid direct instantiation
    }

    public static KeyStoreAndKeyCertOptions verifyOtherKeyStore(KeyStoreConfig ksc, String name) {
        OtherKeyStoreConfig config = ksc.other().orElseThrow();

        if (config.path().isEmpty()) {
            throw new IllegalStateException("Invalid key store configuration for certificate '" + name
                    + "' - no path specified and no KeyStoreFactory found for type '" + config.type() + "'");
        }

        try {
            byte[] data = read(config.path().get());
            String password = CredentialProviders.getKeyStorePassword(config.password(), ksc.credentialsProvider())
                    .orElse(null);
            if (password == null) {
                throw new IllegalStateException("Invalid key store configuration for certificate '" + name
                        + "' - the key store password is not set and cannot be retrieved from the credential provider.");
            }

            KeyStore ks = getInstance(config.type(), config.provider());
            ks.load(new ByteArrayInputStream(data), password.toCharArray());

            KeyStoreOptions options = new KeyStoreOptions();
            options.setType(config.type());
            if (config.provider().isPresent()) {
                options.setProvider(config.provider().get());
            }
            options.setValue(Buffer.buffer(data));
            options.setPassword(password);
            if (config.alias().isPresent()) {
                options.setAlias(config.alias().get());
            }
            String aliasPassword = CredentialProviders.getAliasPassword(config.aliasPassword(), ksc.credentialsProvider())
                    .orElse(null);

View on GitHub (pinned to e1c734241f)

Solutions

Set quarkus.tls.key-store.other.password
Configure a credentials provider (quarkus.tls.key-store.credentials-provider) that supplies the password
Check that the provider-backed env var/secret exists at runtime

Example fix

// before
quarkus.tls.key-store.other.path=certs/ks.p12
// after
quarkus.tls.key-store.other.path=certs/ks.p12
quarkus.tls.key-store.other.password=${KEYSTORE_PASSWORD}

Defensive patterns

Strategy: validation

Validate before calling

boolean passwordResolvable = config.password().isPresent() || credentialsProviderName.isPresent();
if (!passwordResolvable) throw new IllegalArgumentException("Key store password required");

Try / catch

try { init(); } catch (IllegalStateException e) {
    if (e.getMessage().contains("password is not set")) { log.error("Set key-store-other.password or credentials-provider"); }
    throw e;
}

Prevention

Source passwords from env vars/secrets
Test credential provider resolution in CI

When it happens

Trigger: verifyOtherKeyStore reads config, CredentialProviders.getKeyStorePassword returns empty for key-store.other with a path set.

Common situations: Password supplied via environment variable that is not set in the target environment; credential provider name typo; store genuinely has no password but format requires one.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/36880bf7e4e1ac2a. Report an issue: GitHub.