quarkusio/quarkus · error · java.lang.IllegalStateException

Invalid key store configuration for certificate '${name}' -

Error message

Invalid key store configuration for certificate '${name}' - no path specified and no KeyStoreFactory found for type '${type}'

What it means

Thrown by OtherKeyStores.verifyOtherKeyStore when a non-PKCS12/JKS key store configuration has neither a file path nor a registered KeyStoreFactory for its type. The TLS registry resolves 'other' key stores either from a path on disk or in-memory via a KeyStoreFactory contributed by an extension; an empty path plus no factory for the configured type means there is no source for the store, so the configuration guard aborts at startup naming the certificate configuration and type.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java:36

import io.quarkus.tls.runtime.config.OtherTrustStoreConfig;
import io.quarkus.tls.runtime.config.TrustStoreConfig;
import io.vertx.core.buffer.Buffer;
import io.vertx.core.net.KeyStoreOptions;

/**
 * A utility class to load key stores and trust stores with arbitrary types.
 */
public class OtherKeyStores {

    private OtherKeyStores() {
        // Avoid direct instantiation
    }

    public static KeyStoreAndKeyCertOptions verifyOtherKeyStore(KeyStoreConfig ksc, String name) {
        OtherKeyStoreConfig config = ksc.other().orElseThrow();

        if (config.path().isEmpty()) {
            throw new IllegalStateException("Invalid key store configuration for certificate '" + name
                    + "' - no path specified and no KeyStoreFactory found for type '" + config.type() + "'");
        }

        try {
            byte[] data = read(config.path().get());
            String password = CredentialProviders.getKeyStorePassword(config.password(), ksc.credentialsProvider())
                    .orElse(null);
            if (password == null) {
                throw new IllegalStateException("Invalid key store configuration for certificate '" + name
                        + "' - the key store password is not set and cannot be retrieved from the credential provider.");
            }

            KeyStore ks = getInstance(config.type(), config.provider());
            ks.load(new ByteArrayInputStream(data), password.toCharArray());

            KeyStoreOptions options = new KeyStoreOptions();
            options.setType(config.type());
            if (config.provider().isPresent()) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Set quarkus.tls.key-store.other.path to the store file
2. Add the extension/provider that registers a KeyStoreFactory for the configured type
3. Verify the type value is spelled correctly

Example fix

# before
quarkus.tls.key-store.other.type=custom
# after
quarkus.tls.key-store.other.type=custom
quarkus.tls.key-store.other.path=certs/store.custom

if (config.path().isEmpty() && config.type() != null) {
    throw new IllegalArgumentException("Provide quarkus.tls.key-store-other.path or register a KeyStoreFactory for " + config.type());
}

try { buildTlsConfig(); } catch (IllegalStateException e) {
    if (e.getMessage().contains("no path specified")) { log.error("key-store.other requires a path or factory"); }
    throw e;
}

When it happens

Trigger: quarkus.tls.key-store.other.type set (e.g. PEM/custom) but quarkus.tls.key-store.other.path omitted and no io.quarkus.tls.runtime.keystores.KeyStoreFactory registered for that type.

Common situations: Copy-pasting a config block that relies on a custom factory without adding the extension providing it; forgetting the path property.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Failed to load keystore
• No password provided for keystore
• Failed to initialize trust store from classpath resource " +
• Failed to initialize trust store from " + keyStorePath
• Unable to find the TLS configuration ${tlsConfigurationName}

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/90114d06b2026f3b. Report an issue: GitHub.