quarkusio/quarkus · error · java.lang.IllegalStateException

Invalid P12 key store configuration for certificate '${name}

Error message

Invalid P12 key store configuration for certificate '${name}' - cannot read the key store file '${path}'

What it means

The configured P12 key store file could not be read: read(config.path()) threw UncheckedIOException, which the registry wraps into this IllegalStateException naming the certificate and path. The key store is unreadable or does not exist.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java:71

    private static PfxOptions toOptions(P12KeyStoreConfig config, KeyStoreCredentialProviderConfig pc, String name) {
        PfxOptions options = new PfxOptions();
        try {
            options.setValue(Buffer.buffer(read(config.path())));
            String password = CredentialProviders.getKeyStorePassword(config.password(), pc)
                    .orElse(null);
            if (password == null) {
                throw new IllegalStateException("Invalid P12 key store configuration for certificate '" + name
                        + "' - the key store password is not set and cannot be retrieved from the credential provider.");
            }
            options.setPassword(password);
            if (config.alias().isPresent()) {
                options.setAlias(config.alias().get());
            }
            String ap = CredentialProviders.getAliasPassword(config.aliasPassword(), pc).orElse(null);
            options.setAliasPassword(ap);
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid P12 key store configuration for certificate '" + name
                    + "' - cannot read the key store file '" + config.path() + "'", e);
        } catch (Exception e) {
            throw new IllegalStateException("Invalid P12 key store configuration for certificate '" + name + "'", e);
        }
        return options;
    }

    private static PfxOptions toOptions(P12TrustStoreConfig config, TrustStoreCredentialProviderConfig cp, String name) {
        PfxOptions options = new PfxOptions();
        try {
            options.setValue(Buffer.buffer(read(config.path())));
            String password = CredentialProviders.getTrustStorePassword(config.password(), cp)
                    .orElse(null);
            if (password == null) {
                throw new IllegalStateException("Invalid P12 trust store configuration for certificate '" + name
                        + "' - the trust store password is not set and cannot be retrieved from the credential provider.");
            }
            options.setPassword(password);

View on GitHub (pinned to e1c734241f)

Solutions

Fix quarkus.tls.<name>.key-store.p12.path to an existing, readable file path (absolute or correct classpath location)
Ensure the file is packaged (src/main/resources) or mounted into the container and readable by the runtime user
For native builds, confirm the resource is included in the native image (quarkus.native.resources.includes)
Check filesystem permissions (chmod/chown) on the key store file

Example fix

// before: path exists only on laptop
quarkus.tls.my-tls.key-store.p12.path=/Users/me/certs/server.p12
// after: packaged resource
quarkus.tls.my-tls.key-store.p12.path=certs/server.p12

Defensive patterns

Strategy: validation

Validate before calling

Path p = Path.of(configuredPath);
if (!Files.isRegularFile(p) || !Files.isReadable(p)) {
    throw new IllegalStateException("P12 file missing/unreadable: " + p.toAbsolutePath());
}

Try / catch

try {
    // init TLS
} catch (IllegalStateException e) {
    if (e.getMessage() != null && e.getMessage().contains("cannot read the key store file")) {
        log.error("Check path/permissions for the P12 file: " + e.getCause().getMessage());
    }
    throw e;
}

Prevention

Use classpath-relative paths for packaged keystores (src/main/resources)
Include keystore resources in native images (quarkus.native.resources.includes)
Verify container images and K8s mounts contain the file with read permissions
Add a preflight check that stats every configured TLS file path

When it happens

Trigger: quarkus.tls.<name>.key-store.p12.path points to a missing file, a directory, or a file without read permission; classpath-relative path that is not on the classpath at runtime; container image not containing the file.

Common situations: Absolute path valid on dev machine but absent in container; file in src/main/resources not packaged; typo in path; permissions dropped after mounting a K8s secret; native image not including the resource.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/46156935127e3cd3. Report an issue: GitHub.