quarkusio/quarkus · error · java.lang.IllegalStateException

Invalid trust store configuration for certificate '${name}'

Error message

Invalid trust store configuration for certificate '${name}' - cannot read the trust store file '${path}'

What it means

Thrown by OtherKeyStores.verifyOtherTrustStore when reading the configured trust store file fails with an UncheckedIOException: the path is configured but its bytes cannot be loaded (missing file, unreadable permissions, I/O error). The wrapper names the certificate configuration and the failing path and keeps the original IO exception as cause.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java:118

            if (config.provider().isPresent()) {
                options.setProvider(config.provider().get());
            }
            options.setValue(Buffer.buffer(data));
            options.setPassword(password);
            if (config.alias().isPresent()) {
                options.setAlias(config.alias().get());
            }

            verifyTrustStoreAlias(config.alias(), name, ks);

            if (tsc.certificateExpirationPolicy() == TrustStoreConfig.CertificateExpiryPolicy.IGNORE) {
                return new TrustStoreAndTrustOptions(ks, options);
            } else {
                var wrapped = new ExpiryTrustOptions(options, tsc.certificateExpirationPolicy());
                return new TrustStoreAndTrustOptions(ks, wrapped);
            }
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid trust store configuration for certificate '" + name
                    + "' - cannot read the trust store file '" + config.path().get() + "'", e);
        } catch (IllegalStateException | IllegalArgumentException e) {
            throw e;
        } catch (Exception e) {
            throw new IllegalStateException("Invalid trust store configuration for certificate '" + name + "'", e);
        }
    }

    private static KeyStore getInstance(String type, Optional<String> provider) {
        try {
            if (provider.isPresent()) {
                return KeyStore.getInstance(type, provider.get());
            }
            return KeyStore.getInstance(type);
        } catch (KeyStoreException | NoSuchProviderException e) {
            throw new IllegalStateException("Unable to create key store of type '" + type + "'"
                    + (provider.isPresent() ? " with provider '" + provider.get() + "'" : ""), e);
        }

View on GitHub (pinned to e1c734241f)

Solutions

Fix quarkus.tls.trust-store-other.path
Ensure the file exists in the image/container
Check permissions

Example fix

# before
quarkus.tls.trust-store-other.path=/etc/ca.pem
# after
quarkus.tls.trust-store-other.path=/etc/pki/ca-bundle.pem

Defensive patterns

Strategy: validation

Validate before calling

if (!java.nio.file.Files.isReadable(java.nio.file.Path.of(path))) throw new IllegalStateException("Trust store unreadable: " + path);

Try / catch

try { init(); } catch (IllegalStateException e) {
    if (e.getMessage().contains("cannot read the trust store file")) { log.error("Missing trust store: " + path, e.getCause()); }
    throw e;
}

Prevention

Verify CA bundle path in each environment
Ensure configmap/secret mounted before startup

When it happens

Trigger: read(config.path().get()) throws UncheckedIOException — file missing, unreadable, bad mount.

Common situations: CA bundle path typo; configmap/secret not mounted; working-directory difference.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/ff80b2ef12c014d9. Report an issue: GitHub.