quarkusio/quarkus · error · IllegalStateException

Invalid truststore '" + name + "' - The truststore cannot be

Error message

Invalid truststore '" + name + "' - The truststore cannot be configured with a provider and PEM, PKCS12, JKS, or other at the same time

What it means

TrustStoreConfig.validate enforces that a truststore is configured exclusively through the 'provider' mechanism or through concrete store types (PEM/PKCS12/JKS/other), never both. When a credentials provider is available AND at least one of the store types is also configured, this IllegalStateException is thrown at configuration startup.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/TrustStoreConfig.java:83

     * The credential provider configuration for the trust store.
     * A credential provider offers a way to retrieve the trust store password.
     * Note that the credential provider is only used if the password is not set in the configuration.
     */
    TrustStoreCredentialProviderConfig credentialsProvider();

    default void validate(InstanceHandle<TrustStoreProvider> provider, String name) {
        int count = 0;
        if (pem().isPresent())
            count++;
        if (p12().isPresent())
            count++;
        if (jks().isPresent())
            count++;
        if (other().isPresent())
            count++;

        if (provider.isAvailable() && count > 0) {
            throw new IllegalStateException(
                    "Invalid truststore '" + name
                            + "' - The truststore cannot be configured with a provider and PEM, PKCS12, JKS, or other at the same time");
        }

        if (count > 1) {
            throw new IllegalStateException(
                    "Invalid truststore '" + name
                            + "' - Only one truststore type can be configured at a time (PEM, PKCS12, JKS, or other)");
        }
    }

}

View on GitHub (pinned to e1c734241f)

Solutions

1. Remove the trust-store.pem/p12/jks/other entries and keep only provider config
2. Or remove the provider.* config and use the explicit store type only
3. Run the app with dev mode config report to see the full effective trust-store tree and prune duplicates

Example fix

# before
quarkus.tls.my-tls.trust-store.jks.path=trust.jks
quarkus.tls.my-tls.trust-store.jks.password=pw
quarkus.tls.my-tls.trust-store.provider.name=main
# after
quarkus.tls.my-tls.trust-store.jks.path=trust.jks
quarkus.tls.my-tls.trust-store.jks.password=pw

// Ensure only one truststore mechanism is configured
boolean hasProvider = cfg.getOptionalValue("quarkus.tls.my-tls.trust-store.provider.name", String.class).isPresent();
boolean hasStore = Stream.of("pem", "p12", "jks", "other")
    .anyMatch(t -> !cfg.getPropertyNames("quarkus.tls.my-tls.trust-store." + t).isEmpty());
if (hasProvider && hasStore) throw new IllegalStateException("Use provider XOR explicit store type");

try {
    Quarkus.run(args);
} catch (IllegalStateException e) {
    if (e.getMessage().startsWith("Invalid truststore")) {
        log.errorf("Fix truststore config: %s", e.getMessage());
    }
    throw e;
}

When it happens

Trigger: Setting both quarkus.tls.<name>.trust-store.provider.* (credentials provider config making provider available) and any of trust-store.pem / trust-store.p12 / trust-store.jks / trust-store.other in the same named TLS config.

Common situations: Migrating from file-based truststore to a provider-supplied one and leaving the old pem/jks entries behind; copy-pasting a TLS config template that mixes both styles.

Related errors

• Invalid truststore '" + name + "' - Only one truststore type
• Failed to load truststore
• No password provided for truststore
• Failed to initialize trust store from classpath resource " +
• Failed to initialize trust store from " + trustStorePath

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/ea406e1ab07732c6. Report an issue: GitHub.