quarkusio/quarkus · error · java.lang.IllegalStateException

Invalid trust store configuration for certificate '${name}'

Error message

Invalid trust store configuration for certificate '${name}' - the trust store password is not set and cannot be retrieved from the credential provider.

What it means

Thrown by OtherKeyStores.verifyOtherTrustStore when the 'other' trust store's password is unavailable: not set in configuration and not resolvable through the configured credential provider. The store cannot be loaded without its password, so the guard aborts at startup naming the certificate configuration, telling the user to set the password or wire a credentials provider that can supply it.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java:91

        } catch (Exception e) {
            throw new IllegalStateException("Invalid key store configuration for certificate '" + name + "'", e);
        }
    }

    public static TrustStoreAndTrustOptions verifyOtherTrustStore(TrustStoreConfig tsc, String name) {
        OtherTrustStoreConfig config = tsc.other().orElseThrow();

        if (config.path().isEmpty()) {
            throw new IllegalStateException("Invalid trust store configuration for certificate '" + name
                    + "' - no path specified and no TrustStoreFactory found for type '" + config.type() + "'");
        }

        try {
            byte[] data = read(config.path().get());
            String password = CredentialProviders.getTrustStorePassword(config.password(), tsc.credentialsProvider())
                    .orElse(null);
            if (password == null) {
                throw new IllegalStateException("Invalid trust store configuration for certificate '" + name
                        + "' - the trust store password is not set and cannot be retrieved from the credential provider.");
            }

            KeyStore ks = getInstance(config.type(), config.provider());
            ks.load(new ByteArrayInputStream(data), password.toCharArray());

            KeyStoreOptions options = new KeyStoreOptions();
            options.setType(config.type());
            if (config.provider().isPresent()) {
                options.setProvider(config.provider().get());
            }
            options.setValue(Buffer.buffer(data));
            options.setPassword(password);
            if (config.alias().isPresent()) {
                options.setAlias(config.alias().get());
            }

            verifyTrustStoreAlias(config.alias(), name, ks);

View on GitHub (pinned to e1c734241f)

Solutions

1. Set quarkus.tls.trust-store-other.password
2. Configure trust-store credentials provider properly
3. Verify the secret/env exists in the runtime environment

Example fix

# before
quarkus.tls.trust-store-other.path=certs/ts.p12
# after
quarkus.tls.trust-store-other.path=certs/ts.p12
quarkus.tls.trust-store-other.password=changeit

if (config.password().isEmpty() && providerNotConfigured) throw new IllegalArgumentException("Trust store password required");

try { init(); } catch (IllegalStateException e) {
    if (e.getMessage().contains("trust store password is not set")) { log.error("Set trust-store-other.password"); }
    throw e;
}

When it happens

Trigger: verifyOtherTrustStore: CredentialProviders.getTrustStorePassword returns empty for trust-store.other with a path.

Common situations: Env var absent in prod; provider name misconfigured; password stored under different key.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Invalid JKS trust store configuration for certificate '" + n
• Invalid key store configuration for certificate '${name}' -
• Failed to load truststore
• No password provided for truststore
• Failed to initialize trust store from classpath resource " +

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/595cca6338136e68. Report an issue: GitHub.