quarkusio/quarkus · error · IllegalStateException

Invalid truststore '" + name + "' - Only one truststore type

Error message

Invalid truststore '" + name + "' - Only one truststore type can be configured at a time (PEM, PKCS12, JKS, or other)

What it means

TrustStoreConfig.validate counts how many of the truststore types (PEM, PKCS12, JKS, other) are configured. More than one being present is ambiguous, so validate throws this IllegalStateException at startup.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/TrustStoreConfig.java:89

    default void validate(InstanceHandle<TrustStoreProvider> provider, String name) {
        int count = 0;
        if (pem().isPresent())
            count++;
        if (p12().isPresent())
            count++;
        if (jks().isPresent())
            count++;
        if (other().isPresent())
            count++;

        if (provider.isAvailable() && count > 0) {
            throw new IllegalStateException(
                    "Invalid truststore '" + name
                            + "' - The truststore cannot be configured with a provider and PEM, PKCS12, JKS, or other at the same time");
        }

        if (count > 1) {
            throw new IllegalStateException(
                    "Invalid truststore '" + name
                            + "' - Only one truststore type can be configured at a time (PEM, PKCS12, JKS, or other)");
        }
    }

}

View on GitHub (pinned to e1c734241f)

Solutions

1. Keep exactly one truststore type; delete the others
2. Check %profile-scoped properties that may inject a second type
3. Use multiple named TLS bucket configs instead of mixing types in one

Example fix

# before
quarkus.tls.my-tls.trust-store.jks.path=trust.jks
quarkus.tls.my-tls.trust-store.pem.0.cert=ca.pem
# after
quarkus.tls.my-tls.trust-store.pem.0.cert=ca.pem

long types = Stream.of("pem", "p12", "jks", "other")
    .filter(t -> !cfg.getPropertyNames("quarkus.tls.my-tls.trust-store." + t).isEmpty())
    .count();
if (types > 1) throw new IllegalStateException("Configure only one truststore type");

When it happens

Trigger: Configuring two or more of trust-store.pem, trust-store.p12, trust-store.jks, trust-store.other for the same named TLS config (or the default).

Common situations: Adding a PEM cert list while a legacy JKS truststore entry remains; environment variable profiles (e.g. %prod) merging with default values so two types end up set at once.

Related errors

• Invalid truststore '" + name + "' - The truststore cannot be
• Failed to load truststore
• No password provided for truststore
• Failed to initialize trust store from classpath resource " +
• Failed to initialize trust store from " + trustStorePath

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/ce41fb3ed1d6d503. Report an issue: GitHub.