quarkusio/quarkus · error · java.lang.IllegalStateException

Invalid P12 key store configuration for certificate '${name}

Error message

Invalid P12 key store configuration for certificate '${name}'

What it means

A generic catch-all in P12KeyStores.toOptions: any exception while assembling the PfxOptions for the P12 key store (that is not the password or file-read cases) is wrapped into this IllegalStateException naming the certificate. The original cause is attached and must be inspected to know what failed.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java:74

        try {
            options.setValue(Buffer.buffer(read(config.path())));
            String password = CredentialProviders.getKeyStorePassword(config.password(), pc)
                    .orElse(null);
            if (password == null) {
                throw new IllegalStateException("Invalid P12 key store configuration for certificate '" + name
                        + "' - the key store password is not set and cannot be retrieved from the credential provider.");
            }
            options.setPassword(password);
            if (config.alias().isPresent()) {
                options.setAlias(config.alias().get());
            }
            String ap = CredentialProviders.getAliasPassword(config.aliasPassword(), pc).orElse(null);
            options.setAliasPassword(ap);
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid P12 key store configuration for certificate '" + name
                    + "' - cannot read the key store file '" + config.path() + "'", e);
        } catch (Exception e) {
            throw new IllegalStateException("Invalid P12 key store configuration for certificate '" + name + "'", e);
        }
        return options;
    }

    private static PfxOptions toOptions(P12TrustStoreConfig config, TrustStoreCredentialProviderConfig cp, String name) {
        PfxOptions options = new PfxOptions();
        try {
            options.setValue(Buffer.buffer(read(config.path())));
            String password = CredentialProviders.getTrustStorePassword(config.password(), cp)
                    .orElse(null);
            if (password == null) {
                throw new IllegalStateException("Invalid P12 trust store configuration for certificate '" + name
                        + "' - the trust store password is not set and cannot be retrieved from the credential provider.");
            }
            options.setPassword(password);
            if (config.alias().isPresent()) {
                options.setAlias(config.alias().get());
            }

View on GitHub (pinned to e1c734241f)

Solutions

Read the caused-by chain of the IllegalStateException for the root cause
If it involves credential providers, verify the provider configuration and that the referenced secret exists
Re-export the P12 file with standard tooling (keytool) in case the file content is malformed
Update/check the Quarkus and Vert.x versions for known regressions; reproduce with a minimal config

Example fix

// before: provider referenced but not configured
quarkus.tls.my-tls.key-store.credential-provider.name=no-such-provider
// after
quarkus.tls.my-tls.key-store.credential-provider.name=keycloak-credentials-provider

Defensive patterns

Strategy: try-catch

Validate before calling

// Ensure config is complete before starting:
Objects.requireNonNull(cfg.path(), "p12 path required");
Objects.requireNonNull(cfg.password().orElse(providerPassword), "p12 password required");

Try / catch

try {
    // init TLS
} catch (IllegalStateException e) {
    if (e.getMessage() != null && e.getMessage().equals("Invalid P12 key store configuration for certificate 'my-cert'")) {
        log.error("Inspect cause for root failure", e.getCause());
    }
    throw e;
}

Prevention

Always read the caused-by chain — this message is generic by design
Keep credential provider config minimal and tested
Validate generated P12 files with keytool -list after every regeneration
Pin and test Quarkus/Vert.x versions used with custom credential providers

When it happens

Trigger: Any Exception thrown inside toOptions after the file read — e.g. failures resolving alias/alias-password through the credential provider, buffer/encoding errors, or provider issues — not covered by the UncheckedIOException branch.

Common situations: Credential provider throwing while fetching the alias password; malformed path expression causing unexpected runtime exception; Vert.x buffer creation failure on odd file content; bugs/regressions in extension versions.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/f0a7b614e4e2740f. Report an issue: GitHub.