quarkusio/quarkus · error · java.lang.IllegalStateException

Invalid P12 trust store configuration for certificate '${nam

Error message

Invalid P12 trust store configuration for certificate '${name}' - cannot read the trust store file '${path}'

What it means

Quarkus reads the P12 trust store file into memory when constructing PfxOptions. If that read fails with an UncheckedIOException, the error is wrapped in an IllegalStateException stating the trust store file could not be read.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java:94

        return options;
    }

    private static PfxOptions toOptions(P12TrustStoreConfig config, TrustStoreCredentialProviderConfig cp, String name) {
        PfxOptions options = new PfxOptions();
        try {
            options.setValue(Buffer.buffer(read(config.path())));
            String password = CredentialProviders.getTrustStorePassword(config.password(), cp)
                    .orElse(null);
            if (password == null) {
                throw new IllegalStateException("Invalid P12 trust store configuration for certificate '" + name
                        + "' - the trust store password is not set and cannot be retrieved from the credential provider.");
            }
            options.setPassword(password);
            if (config.alias().isPresent()) {
                options.setAlias(config.alias().get());
            }
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid P12 trust store configuration for certificate '" + name
                    + "' - cannot read the trust store file '" + config.path() + "'", e);
        } catch (Exception e) {
            throw new IllegalStateException("Invalid P12 trust store configuration for certificate '" + name + "'", e);
        }
        return options;
    }

    private static void verifyKeyStoreAlias(PfxOptions options, String name,
            KeyStore ks) {
        String alias = options.getAlias();
        String aliasPassword = options.getAliasPassword();
        if (alias != null) {
            try {
                if (ks.getCertificate(alias) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in P12 key store (certificate not found)'" + name + "'");
                }
            } catch (KeyStoreException e) {

View on GitHub (pinned to e1c734241f)

Solutions

Verify the path exists and is readable at runtime; use a classpath:/... or absolute path
Ensure the .p12 file is included in the build (src/main/resources or container image layer)
Correct the quarkus.tls.<name>.trust-store.p12.path value
Check file permissions for the runtime user

Example fix

// before
quarkus.tls.my-cert.trust-store.p12.path=./truststore.p12
// after
quarkus.tls.my-cert.trust-store.p12.path=classpath:certs/truststore.p12

Defensive patterns

Strategy: validation

Validate before calling

Path p = Path.of(configuredPath);
if (!Files.isReadable(p)) {
    throw new IllegalArgumentException("Trust store not readable: " + p.toAbsolutePath());
}

Try / catch

try {
    tlsRegistry.get("my-cert");
} catch (IllegalStateException e) {
    if (e.getMessage().contains("cannot read the trust store file")) {
        log.error("Check trust-store.p12.path; caused by: ", e.getCause());
    }
}

Prevention

Use classpath:/ paths for resources packaged in the artifact
Verify container/native-image builds include the .p12 file
Use absolute paths when files live outside the app working directory
Add a startup smoke test that loads every configured TLS bundle

When it happens

Trigger: P12TrustStoreConfig.path() points to a nonexistent, unreadable, or invalid path; read() throws UncheckedIOException during toOptions for the named certificate's trust store.

Common situations: Wrong relative path (file outside the working directory), file not packaged in the container/native image, typo in quarkus.tls.<name>.trust-store.p12.path, permissions issue after containerization.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/8d335917e81c36b0. Report an issue: GitHub.