quarkusio/quarkus · error · java.lang.IllegalStateException

Invalid trust store configuration for certificate '${name}'

Error message

Invalid trust store configuration for certificate '${name}' - no path specified and no TrustStoreFactory found for type '${type}'

What it means

Thrown by OtherKeyStores.verifyOtherTrustStore when a non-PKCS12/JKS trust store configuration provides neither a path nor a registered TrustStoreFactory for the configured type. Trust stores of 'other' types must come from a readable file or from an in-memory TrustStoreFactory contributed by an extension; with both absent there is no source of certificates to trust, so the startup-time guard fires naming the certificate configuration and store type.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java:82

            options.setAliasPassword(aliasPassword);

            verifyKeyStoreAlias(config, name, ks, aliasPassword);
            return new KeyStoreAndKeyCertOptions(ks, options);
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid key store configuration for certificate '" + name
                    + "' - cannot read the key store file '" + config.path().get() + "'", e);
        } catch (IllegalStateException | IllegalArgumentException e) {
            throw e;
        } catch (Exception e) {
            throw new IllegalStateException("Invalid key store configuration for certificate '" + name + "'", e);
        }
    }

    public static TrustStoreAndTrustOptions verifyOtherTrustStore(TrustStoreConfig tsc, String name) {
        OtherTrustStoreConfig config = tsc.other().orElseThrow();

        if (config.path().isEmpty()) {
            throw new IllegalStateException("Invalid trust store configuration for certificate '" + name
                    + "' - no path specified and no TrustStoreFactory found for type '" + config.type() + "'");
        }

        try {
            byte[] data = read(config.path().get());
            String password = CredentialProviders.getTrustStorePassword(config.password(), tsc.credentialsProvider())
                    .orElse(null);
            if (password == null) {
                throw new IllegalStateException("Invalid trust store configuration for certificate '" + name
                        + "' - the trust store password is not set and cannot be retrieved from the credential provider.");
            }

            KeyStore ks = getInstance(config.type(), config.provider());
            ks.load(new ByteArrayInputStream(data), password.toCharArray());

            KeyStoreOptions options = new KeyStoreOptions();
            options.setType(config.type());
            if (config.provider().isPresent()) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Set quarkus.tls.trust-store-other.path
2. Add the extension providing the TrustStoreFactory
3. Correct the type name

Example fix

# before
quarkus.tls.trust-store-other.type=custom
# after
quarkus.tls.trust-store-other.type=custom
quarkus.tls.trust-store-other.path=certs/trust.custom

if (config.path().isEmpty()) throw new IllegalArgumentException("trust-store-other.path is required");

try { init(); } catch (IllegalStateException e) {
    if (e.getMessage().contains("Invalid trust store")) { log.error("Set trust-store-other.path or add TrustStoreFactory"); }
    throw e;
}

When it happens

Trigger: verifyOtherTrustStore: quarkus.tls.trust-store-other.type set without path and no TrustStoreFactory registered for that type.

Common situations: Using a custom trust store type requiring an extension that isn't a dependency; forgetting the path.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Failed to load truststore
• No password provided for truststore
• Failed to initialize trust store from classpath resource " +
• Failed to initialize trust store from " + trustStorePath
• The trust-all option cannot be used when a trust-store is co

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/c9c552c44fb5f102. Report an issue: GitHub.