quarkusio/quarkus · error · java.lang.IllegalStateException

Invalid key store configuration for certificate '${name}'

Error message

Invalid key store configuration for certificate '${name}'

What it means

Thrown by OtherKeyStores.verifyOtherKeyStore as the catch-all wrapper for any unexpected exception during 'other' key store setup — loading, alias verification or options construction — that is not already an UncheckedIOException, IllegalStateException or IllegalArgumentException (those are rethrown as-is). The original exception is attached as the cause; the message alone carries no detail, so the caused-by chain must be consulted to find the underlying failure.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java:74

            }
            options.setValue(Buffer.buffer(data));
            options.setPassword(password);
            if (config.alias().isPresent()) {
                options.setAlias(config.alias().get());
            }
            String aliasPassword = CredentialProviders.getAliasPassword(config.aliasPassword(), ksc.credentialsProvider())
                    .orElse(null);
            options.setAliasPassword(aliasPassword);

            verifyKeyStoreAlias(config, name, ks, aliasPassword);
            return new KeyStoreAndKeyCertOptions(ks, options);
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid key store configuration for certificate '" + name
                    + "' - cannot read the key store file '" + config.path().get() + "'", e);
        } catch (IllegalStateException | IllegalArgumentException e) {
            throw e;
        } catch (Exception e) {
            throw new IllegalStateException("Invalid key store configuration for certificate '" + name + "'", e);
        }
    }

    public static TrustStoreAndTrustOptions verifyOtherTrustStore(TrustStoreConfig tsc, String name) {
        OtherTrustStoreConfig config = tsc.other().orElseThrow();

        if (config.path().isEmpty()) {
            throw new IllegalStateException("Invalid trust store configuration for certificate '" + name
                    + "' - no path specified and no TrustStoreFactory found for type '" + config.type() + "'");
        }

        try {
            byte[] data = read(config.path().get());
            String password = CredentialProviders.getTrustStorePassword(config.password(), tsc.credentialsProvider())
                    .orElse(null);
            if (password == null) {
                throw new IllegalStateException("Invalid trust store configuration for certificate '" + name
                        + "' - the trust store password is not set and cannot be retrieved from the credential provider.");

View on GitHub (pinned to e1c734241f)

Solutions

1. Inspect the cause chain for the root exception
2. Confirm the file format matches quarkus.tls.key-store.other.type
3. Re-export/convert the store with keytool or openssl

Example fix

# before
quarkus.tls.key-store.other.type=p12  # file is actually JKS
# after
quarkus.tls.key-store.other.type=JKS

try { init(); } catch (IllegalStateException e) {
    Throwable root = e; while (root.getCause() != null) root = root.getCause();
    log.error("Key store load failed: " + root.getMessage()); throw e;
}

When it happens

Trigger: ks.load() throws e.g. InvalidKeySpecException/IOException due to wrong format, wrong type declared, or alias verification failure not covered elsewhere.

Common situations: Declaring type=p12 for an actual JKS file; corrupted store; unsupported provider output.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Failed to load keystore
• No password provided for keystore
• Failed to initialize trust store from classpath resource " +
• Failed to initialize trust store from " + keyStorePath
• No certificate found with alias: <alias>

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/89fa12dd289d1aa9. Report an issue: GitHub.