quarkusio/quarkus · error · IllegalStateException

Invalid keystore '" + name + "' - Only one keystore type can

Error message

Invalid keystore '" + name + "' - Only one keystore type can be configured at a time (PEM, PKCS12, JKS, or other)

What it means

Quarkus TLS registry validation: each named keystore config (quarkus.tls.<name>.key-store.*) may define exactly one of the four mutually exclusive keystore sources — pem, p12, jks, or other. KeyStoreConfig.validate counts how many of these optional groups are present and throws an IllegalStateException when more than one is set, because the registry cannot decide which source supplies the key material.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/KeyStoreConfig.java:81

    default void validate(InstanceHandle<KeyStoreProvider> provider, String name) {
        int count = 0;
        if (pem().isPresent())
            count++;
        if (p12().isPresent())
            count++;
        if (jks().isPresent())
            count++;
        if (other().isPresent())
            count++;

        if (provider.isAvailable() && count > 0) {
            throw new IllegalStateException(
                    "Invalid keystore '" + name
                            + "' - The keystore cannot be configured with a provider and PEM, PKCS12, JKS, or other at the same time");
        }

        if (count > 1) {
            throw new IllegalStateException(
                    "Invalid keystore '" + name
                            + "' - Only one keystore type can be configured at a time (PEM, PKCS12, JKS, or other)");
        }
    }

}

View on GitHub (pinned to e1c734241f)

Solutions

Remove all but one of the pem/p12/jks/other blocks under quarkus.tls.<name>.key-store
If you need a custom provider, remove the inline key-store type blocks entirely and rely on the KeyStoreProvider bean
Verify resolved config with quarkus.config: run with -Dquarkus.log.category."io.quarkus.tls".level=DEBUG and inspect which groups are present

Example fix

// before
quarkus.tls.my.key-store.jks.path=keystore.jks
quarkus.tls.my.key-store.jks.password=secret
quarkus.tls.my.key-store.pem.0.cert=cert.crt
quarkus.tls.my.key-store.pem.0.key=key.pem
// after
quarkus.tls.my.key-store.pem.0.cert=cert.crt
quarkus.tls.my.key-store.pem.0.key=key.pem

Defensive patterns

Strategy: validation

Validate before calling

int count = 0;
if (config.keyStore().pem().isPresent()) count++;
if (config.keyStore().p12().isPresent()) count++;
if (config.keyStore().jks().isPresent()) count++;
if (config.keyStore().other().isPresent()) count++;
if (count > 1) throw new IllegalStateException("At most one of pem/p12/jks/other may be set for key-store");

Prevention

Keep only one keystore source block per named TLS bucket in application.properties
After migrating keystore formats, delete the old block in the same commit
Use distinct quarkus.tls.<name> buckets per format instead of mixing types in one
Review effective config (SmallRye Config report) in CI to catch leftover blocks

When it happens

Trigger: Setting two or more of quarkus.tls.<name>.key-store.pem.*, .p12.*, .jks.*, or .other.* in application.properties for the same keystore name; validation runs when the TlsRegistryProducers build the certificate config at startup.

Common situations: Migrating from a JKS keystore to PEM files and leaving the old jks block behind; copy-pasting a sample p12 config next to an existing pem config; combining an 'other' (e.g. BCFKS/PKCS11) block with a jks block to 'also' support the default type.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/7388f359cf8a3ee4. Report an issue: GitHub.