quarkusio/quarkus · error · java.lang.IllegalStateException

Invalid P12 key store configuration for certificate '${name}

Error message

Invalid P12 key store configuration for certificate '${name}' - the key store password is not set and cannot be retrieved from the credential provider.

What it means

When building Vert.x PfxOptions for a P12 key store, the TLS registry resolves the key store password from configuration or a credential provider. If neither yields a password, it throws this error because a P12 key store cannot be opened without one.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java:61

        PfxOptions options = toOptions(p12Config, config.credentialsProvider(), name);
        KeyStore ks = loadKeyStore(vertx, name, options, "trust");
        verifyTrustStoreAlias(p12Config.alias(), name, ks);
        if (config.certificateExpirationPolicy() == TrustStoreConfig.CertificateExpiryPolicy.IGNORE) {
            return new TrustStoreAndTrustOptions(ks, options);
        } else {
            var wrapped = new ExpiryTrustOptions(options, config.certificateExpirationPolicy());
            return new TrustStoreAndTrustOptions(ks, wrapped);
        }
    }

    private static PfxOptions toOptions(P12KeyStoreConfig config, KeyStoreCredentialProviderConfig pc, String name) {
        PfxOptions options = new PfxOptions();
        try {
            options.setValue(Buffer.buffer(read(config.path())));
            String password = CredentialProviders.getKeyStorePassword(config.password(), pc)
                    .orElse(null);
            if (password == null) {
                throw new IllegalStateException("Invalid P12 key store configuration for certificate '" + name
                        + "' - the key store password is not set and cannot be retrieved from the credential provider.");
            }
            options.setPassword(password);
            if (config.alias().isPresent()) {
                options.setAlias(config.alias().get());
            }
            String ap = CredentialProviders.getAliasPassword(config.aliasPassword(), pc).orElse(null);
            options.setAliasPassword(ap);
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid P12 key store configuration for certificate '" + name
                    + "' - cannot read the key store file '" + config.path() + "'", e);
        } catch (Exception e) {
            throw new IllegalStateException("Invalid P12 key store configuration for certificate '" + name + "'", e);
        }
        return options;
    }

    private static PfxOptions toOptions(P12TrustStoreConfig config, TrustStoreCredentialProviderConfig cp, String name) {

View on GitHub (pinned to e1c734241f)

Solutions

Set quarkus.tls.<name>.key-store.p12.password=<password> in configuration
Configure the credential provider (e.g. quarkus.tls.key-store.credential-provider.name / credentials provider group) so the secret can be resolved
Check the environment variable / mounted secret actually has a value in the deployment
If the P12 truly has an empty password, provide an explicit empty-string password if your tooling produced one

Example fix

// before
quarkus.tls.my-tls.key-store.p12.path=certs/server.p12
// after
quarkus.tls.my-tls.key-store.p12.path=certs/server.p12
quarkus.tls.my-tls.key-store.p12.password=${KEYSTORE_PASSWORD}

Defensive patterns

Strategy: validation

Validate before calling

String password = System.getenv("KEYSTORE_PASSWORD");
if (password == null || password.isBlank()) {
    throw new IllegalStateException("Set quarkus.tls.<name>.key-store.p12.password or configure a credential provider");
}

Try / catch

try {
    // start app
} catch (IllegalStateException e) {
    if (e.getMessage() != null && e.getMessage().contains("key store password is not set")) {
        log.error("Provide quarkus.tls.<name>.key-store.p12.password or a working credential provider");
    }
    throw e;
}

Prevention

Always set the p12 password property (possibly via property expansion from an env var)
Verify credential provider name/group matches an actually registered provider
Add startup config validation in CI with the same profile used in prod
Check Kubernetes secret mounts actually inject the expected key

When it happens

Trigger: quarkus.tls.<name>.key-store.p12.password is unset/blank and no credential provider is configured (or the provider returns empty) when P12KeyStores.toOptions builds the key store options.

Common situations: Relying on a credential provider that is not registered or whose name does not match; password provided via env var that is empty in the target environment; migrating config and forgetting the password property; K8s secret not mounted.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/8a99161159b5117a. Report an issue: GitHub.