quarkusio/quarkus · error · IllegalStateException

Invalid keystore '" + name + "' - The keystore cannot be con

Error message

Invalid keystore '" + name + "' - The keystore cannot be configured with a provider and PEM, PKCS12, JKS, or other at the same time

What it means

A keystore configuration must pick exactly one source: either a Java Security provider-backed keystore, or one of the file/format-based options (PEM, PKCS12, JKS, other). KeyStoreConfig.validate throws IllegalStateException when a provider is available AND at least one format option is also set, since these sources are mutually exclusive.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/KeyStoreConfig.java:75

     * The credential provider configuration for the keys store.
     * A credential provider offers a way to retrieve the key store password and alias password.
     * Note that the credential provider is only used if the password / alias password are not set in the configuration.
     */
    KeyStoreCredentialProviderConfig credentialsProvider();

    default void validate(InstanceHandle<KeyStoreProvider> provider, String name) {
        int count = 0;
        if (pem().isPresent())
            count++;
        if (p12().isPresent())
            count++;
        if (jks().isPresent())
            count++;
        if (other().isPresent())
            count++;

        if (provider.isAvailable() && count > 0) {
            throw new IllegalStateException(
                    "Invalid keystore '" + name
                            + "' - The keystore cannot be configured with a provider and PEM, PKCS12, JKS, or other at the same time");
        }

        if (count > 1) {
            throw new IllegalStateException(
                    "Invalid keystore '" + name
                            + "' - Only one keystore type can be configured at a time (PEM, PKCS12, JKS, or other)");
        }
    }

}

View on GitHub (pinned to e1c734241f)

Solutions

Remove the provider setting if you intend to use a file/format-based keystore (keep only pem, pkcs12, jks, or other).
Remove the pem/pkcs12/jks/other properties if you intend to use the provider-backed keystore.
Re-check application.properties, environment variables, and any config profiles (e.g. %prod.) for leftover keystore options; validate the effective config with quarkus config editor or `quarkus config` tooling.

Example fix

// before (application.properties)
quarkus.tls.my-tls.key-store.provider.name=MDB
quarkus.tls.my-tls.key-store.pkcs12.path=certs/keystore.p12
// after
quarkus.tls.my-tls.key-store.pkcs12.path=certs/keystore.p12
# or, for provider-backed: remove the pkcs12 line and keep only the provider settings

Defensive patterns

Strategy: validation

Validate before calling

KeyStoreConfig ks = ...; // from quarkus.tls.<name>.key-store
if (ks.provider().isAvailable() && (ks.pem().isPresent() || ks.pkcs12().isPresent()
        || ks.jks().isPresent() || ks.other().isPresent())) {
    throw new IllegalStateException("key-store must use either provider or a file-based format, not both");
}

Type guard

boolean hasExactlyOneSource(KeyStoreConfig ks) {
    int count = (ks.pem().isPresent()?1:0) + (ks.pkcs12().isPresent()?1:0)
              + (ks.jks().isPresent()?1:0) + (ks.other().isPresent()?1:0);
    return ks.provider().isAvailable() ? count == 0 : count == 1;
}

Try / catch

try {
    TlsConfiguration cfg = TlsConfiguration.fromConfig("my-tls");
} catch (IllegalStateException e) {
    log.errorf("Keystore config invalid: %s", e.getMessage());
}

Prevention

Set only one keystore source block per named TLS config (pem XOR pkcs12 XOR jks XOR other XOR provider).
When migrating between keystore sources, delete the old properties instead of commenting them out.
Check environment variables and config profiles for hidden keystore settings that activate the provider path.
Run a build/test that boots the TLS registry early to surface validate() failures at startup.

When it happens

Trigger: Configuring quarkus.tls.<name>.key-store with a provider (quarkus.tls.<name>.key-store.provider set/available) while also setting pem, pkcs12, jks, or other properties; also triggered programmatically when validate() runs on such a mixed mapping.

Common situations: Copy-pasting example config that includes both provider and pkcs12 options; switching from file-based to provider-based keystore but leaving old pem/pkcs12/jks properties in application.properties or an imported config; environment variables/config source supplying a provider name unexpectedly.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/0cbc74e3ab7e090a. Report an issue: GitHub.