quarkusio/quarkus · error · java.lang.IllegalStateException

Invalid P12 trust store configuration for certificate '${nam

Error message

Invalid P12 trust store configuration for certificate '${name}' - the trust store password is not set and cannot be retrieved from the credential provider.

What it means

During TLS registry startup, Quarkus builds the Vert.x PfxOptions for a P12 trust store. The trust store password is resolved first from the configured password property, then from the configured credential provider; if neither yields a password, an IllegalStateException is thrown because a P12 file cannot be opened without one.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java:86

            String ap = CredentialProviders.getAliasPassword(config.aliasPassword(), pc).orElse(null);
            options.setAliasPassword(ap);
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid P12 key store configuration for certificate '" + name
                    + "' - cannot read the key store file '" + config.path() + "'", e);
        } catch (Exception e) {
            throw new IllegalStateException("Invalid P12 key store configuration for certificate '" + name + "'", e);
        }
        return options;
    }

    private static PfxOptions toOptions(P12TrustStoreConfig config, TrustStoreCredentialProviderConfig cp, String name) {
        PfxOptions options = new PfxOptions();
        try {
            options.setValue(Buffer.buffer(read(config.path())));
            String password = CredentialProviders.getTrustStorePassword(config.password(), cp)
                    .orElse(null);
            if (password == null) {
                throw new IllegalStateException("Invalid P12 trust store configuration for certificate '" + name
                        + "' - the trust store password is not set and cannot be retrieved from the credential provider.");
            }
            options.setPassword(password);
            if (config.alias().isPresent()) {
                options.setAlias(config.alias().get());
            }
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid P12 trust store configuration for certificate '" + name
                    + "' - cannot read the trust store file '" + config.path() + "'", e);
        } catch (Exception e) {
            throw new IllegalStateException("Invalid P12 trust store configuration for certificate '" + name + "'", e);
        }
        return options;
    }

    private static void verifyKeyStoreAlias(PfxOptions options, String name,
            KeyStore ks) {
        String alias = options.getAlias();

View on GitHub (pinned to e1c734241f)

Solutions

Set quarkus.tls.<name>.trust-store.p12.password in application.properties
Configure a trust-store credential provider that supplies the password
If the P12 has an empty password, explicitly set password= (empty) if supported rather than omitting it
Check the quarkus.tls.<name>.trust-store.credentials-provider mapping for correct name/key

Example fix

// before
quarkus.tls.my-cert.trust-store.p12.path=truststore.p12
// after
quarkus.tls.my-cert.trust-store.p12.path=truststore.p12
quarkus.tls.my-cert.trust-store.p12.password=changeit

Defensive patterns

Strategy: validation

Validate before calling

if (config.trustStore().p12().isPresent()) {
    boolean hasPassword = config.trustStore().p12().get().password().isPresent()
        || credentialProviderSuppliesTrustStorePassword();
    if (!hasPassword) {
        throw new IllegalArgumentException("P12 trust store for 'my-cert' needs a password or credential provider");
    }
}

Try / catch

try {
    tlsRegistry.get("my-cert");
} catch (IllegalStateException e) {
    if (e.getMessage().contains("trust store password is not set")) {
        log.error("Set quarkus.tls.my-cert.trust-store.p12.password or a credential provider");
    }
}

Prevention

Always set the p12 password alongside the p12 path in TLS config
Use a credential provider backed by the environment/vault for production secrets
Test TLS bundle startup in CI so missing passwords fail the build, not production
Keep trust-store and key-store credential provider configs distinct and correctly named

When it happens

Trigger: quarkus.tls.*.trust-store.p12.path is configured but quarkus.tls.*.trust-store.p12.password is unset and no trust-store credential provider (or one that returns no password) is configured for the named certificate bundle.

Common situations: Trust store password managed in a vault/credential provider that is not registered; config key typo (password under wrong prefix); migrating to the TLS registry and forgetting the password property; empty password resolved by the provider treated as missing.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/69863979505ecfbd. Report an issue: GitHub.