quarkusio/quarkus · error · java.lang.IllegalStateException

Invalid P12 trust store configuration for certificate '${nam

Error message

Invalid P12 trust store configuration for certificate '${name}'

What it means

Generic fallback in P12 trust store option construction: any exception other than UncheckedIOException while building PfxOptions for the trust store is wrapped as 'Invalid P12 trust store configuration for certificate <name>'. The cause carries the real failure.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java:97

    private static PfxOptions toOptions(P12TrustStoreConfig config, TrustStoreCredentialProviderConfig cp, String name) {
        PfxOptions options = new PfxOptions();
        try {
            options.setValue(Buffer.buffer(read(config.path())));
            String password = CredentialProviders.getTrustStorePassword(config.password(), cp)
                    .orElse(null);
            if (password == null) {
                throw new IllegalStateException("Invalid P12 trust store configuration for certificate '" + name
                        + "' - the trust store password is not set and cannot be retrieved from the credential provider.");
            }
            options.setPassword(password);
            if (config.alias().isPresent()) {
                options.setAlias(config.alias().get());
            }
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid P12 trust store configuration for certificate '" + name
                    + "' - cannot read the trust store file '" + config.path() + "'", e);
        } catch (Exception e) {
            throw new IllegalStateException("Invalid P12 trust store configuration for certificate '" + name + "'", e);
        }
        return options;
    }

    private static void verifyKeyStoreAlias(PfxOptions options, String name,
            KeyStore ks) {
        String alias = options.getAlias();
        String aliasPassword = options.getAliasPassword();
        if (alias != null) {
            try {
                if (ks.getCertificate(alias) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in P12 key store (certificate not found)'" + name + "'");
                }
            } catch (KeyStoreException e) {
                throw new IllegalStateException("Unable to verify alias '" + alias + "' in P12 key store '" + name + "'", e);
            }

View on GitHub (pinned to e1c734241f)

Solutions

Inspect the 'Caused by' of the IllegalStateException for the root cause
Validate all quarkus.tls.<name>.trust-store.p12.* properties (path, password, alias)
Temporarily log config values to find which property is malformed
Simplify to a plain file path + password to isolate the failing option

Example fix

// before
quarkus.tls.my-cert.trust-store.p12.alias=wrong-alias
// after
quarkus.tls.my-cert.trust-store.p12.alias=trusted-ca

Defensive patterns

Strategy: try-catch

Validate before calling

// Validate all trust-store p12 options (path readable, password resolvable, alias syntax) before startup
Files.isReadable(Path.of(path));
Objects.requireNonNull(password, "p12 password required");

Try / catch

try {
    tlsRegistry.get("my-cert");
} catch (IllegalStateException e) {
    log.error("Trust store setup failed for my-cert; root cause:", e.getCause());
}

Prevention

Always log/print the cause chain — this is a generic wrapper
Keep the P12 config minimal (path, password, optional alias) to reduce failure surface
Pin JDK/provider versions to avoid unexpected option-building failures

When it happens

Trigger: Any unexpected exception thrown inside the toOptions(P12TrustStoreConfig,...) try block (e.g., from config access or buffer creation) that is not an UncheckedIOException and not the missing-password case.

Common situations: Reactive config access failure, unexpected provider exception, internal errors while assembling the trust store options for the named certificate bundle.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/2742ed396d42d81a. Report an issue: GitHub.