quarkusio/quarkus · error · java.lang.IllegalStateException

Invalid trust store configuration for certificate '${name}'

Error message

Invalid trust store configuration for certificate '${name}'

What it means

Thrown by OtherKeyStores.verifyOtherTrustStore as the final catch-all around trust store loading, alias verification and expiry-options wrapping for any exception not handled by the narrower catches (UncheckedIOException and IllegalStateException/IllegalArgumentException are rethrown unchanged). Like its key-store counterpart, the message is a bare wrapper carrying no detail — the attached cause identifies the actual failure (e.g. a KeyStoreException from a malformed store).

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java:123

            if (config.alias().isPresent()) {
                options.setAlias(config.alias().get());
            }

            verifyTrustStoreAlias(config.alias(), name, ks);

            if (tsc.certificateExpirationPolicy() == TrustStoreConfig.CertificateExpiryPolicy.IGNORE) {
                return new TrustStoreAndTrustOptions(ks, options);
            } else {
                var wrapped = new ExpiryTrustOptions(options, tsc.certificateExpirationPolicy());
                return new TrustStoreAndTrustOptions(ks, wrapped);
            }
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid trust store configuration for certificate '" + name
                    + "' - cannot read the trust store file '" + config.path().get() + "'", e);
        } catch (IllegalStateException | IllegalArgumentException e) {
            throw e;
        } catch (Exception e) {
            throw new IllegalStateException("Invalid trust store configuration for certificate '" + name + "'", e);
        }
    }

    private static KeyStore getInstance(String type, Optional<String> provider) {
        try {
            if (provider.isPresent()) {
                return KeyStore.getInstance(type, provider.get());
            }
            return KeyStore.getInstance(type);
        } catch (KeyStoreException | NoSuchProviderException e) {
            throw new IllegalStateException("Unable to create key store of type '" + type + "'"
                    + (provider.isPresent() ? " with provider '" + provider.get() + "'" : ""), e);
        }
    }

    private static void verifyKeyStoreAlias(OtherKeyStoreConfig config, String name, KeyStore ks,
            String aliasPassword) {
        if (config.alias().isPresent()) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Read the cause for the underlying error
2. Verify declared type matches file content
3. Regenerate/re-download the trust store

Example fix

// before
KeyStore ks = OtherKeyStores.load(data, "p12"); // file is PEM
// after
KeyStore ks = OtherKeyStores.load(pemBytes, "PEM");

try { init(); } catch (IllegalStateException e) {
    Throwable root = e; while (root.getCause() != null) root = root.getCause();
    log.error("Trust store load failed: " + root.getMessage()); throw e;
}

When it happens

Trigger: ks.load() throws format/parse errors, e.g. trust store bytes are not the declared type.

Common situations: PEM bundle fed where PKCS12 declared; corrupt download; truncated secret mount.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Failed to load truststore
• No password provided for truststore
• Failed to initialize trust store from classpath resource " +
• Failed to initialize trust store from " + trustStorePath
• The trust-all option cannot be used when a trust-store is co

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/3caab21715029385. Report an issue: GitHub.