quarkusio/quarkus · error · java.lang.IllegalStateException

Invalid key store configuration for certificate '${name}' -

Error message

Invalid key store configuration for certificate '${name}' - cannot read the key store file '${path}'

What it means

Thrown by OtherKeyStores.verifyOtherKeyStore when reading the configured key store file fails with an UncheckedIOException — the path exists in configuration but the bytes cannot be read (missing file, permission denied, truncated). The read failure is caught around the whole load block and rethrown as this IllegalStateException naming the certificate configuration and the offending path, with the IO cause attached.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java:69

            KeyStoreOptions options = new KeyStoreOptions();
            options.setType(config.type());
            if (config.provider().isPresent()) {
                options.setProvider(config.provider().get());
            }
            options.setValue(Buffer.buffer(data));
            options.setPassword(password);
            if (config.alias().isPresent()) {
                options.setAlias(config.alias().get());
            }
            String aliasPassword = CredentialProviders.getAliasPassword(config.aliasPassword(), ksc.credentialsProvider())
                    .orElse(null);
            options.setAliasPassword(aliasPassword);

            verifyKeyStoreAlias(config, name, ks, aliasPassword);
            return new KeyStoreAndKeyCertOptions(ks, options);
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid key store configuration for certificate '" + name
                    + "' - cannot read the key store file '" + config.path().get() + "'", e);
        } catch (IllegalStateException | IllegalArgumentException e) {
            throw e;
        } catch (Exception e) {
            throw new IllegalStateException("Invalid key store configuration for certificate '" + name + "'", e);
        }
    }

    public static TrustStoreAndTrustOptions verifyOtherTrustStore(TrustStoreConfig tsc, String name) {
        OtherTrustStoreConfig config = tsc.other().orElseThrow();

        if (config.path().isEmpty()) {
            throw new IllegalStateException("Invalid trust store configuration for certificate '" + name
                    + "' - no path specified and no TrustStoreFactory found for type '" + config.type() + "'");
        }

        try {
            byte[] data = read(config.path().get());

View on GitHub (pinned to e1c734241f)

Solutions

Fix the path or make it absolute / resolve from classpath: quarkus.tls.key-store.other.path
Ensure the file is packaged or mounted in the deployment
Check file read permissions

Example fix

# before
quarkus.tls.key-store.other.path=./ks.p12
# after
quarkus.tls.key-store.other.path=certs/ks.p12

Defensive patterns

Strategy: validation

Validate before calling

if (!java.nio.file.Files.isReadable(java.nio.file.Path.of(path))) {
    throw new IllegalStateException("Key store file not readable: " + path);
}

Try / catch

try { init(); } catch (IllegalStateException e) {
    if (e.getMessage().contains("cannot read the key store file")) { log.error("File missing/unreadable: " + path, e.getCause()); }
    throw e;
}

Prevention

Use classpath paths packaged in the artifact
Verify mounts in container images
Use absolute paths in prod

When it happens

Trigger: config.path().get() passed to read() throws UncheckedIOException — missing file, no read permission, bad filesystem mount.

Common situations: Path relative to working directory that differs in container/prod; secret not mounted; typo in path.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/cc8ad9a30976d3ca. Report an issue: GitHub.