quarkusio/quarkus · critical · IllegalStateException

Neither public key nor certificate chain verification modes

Error message

Neither public key nor certificate chain verification modes are enabled

What it means

OidcProvider constructed for local (offline) JWT verification requires either a public key (quarkus.oidc.public-key) or a certificate chain trust store. This IllegalStateException is thrown from the constructor when neither is configured, meaning there is no key material to verify token signatures.

Source

Thrown at extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcProvider.java:132

        this.audience = checkAudienceProp();
        this.requiredClaims = checkRequiredClaimsProp();
        this.requiredAlgorithmConstraints = checkSignatureAlgorithm();
        this.customValidators = customValidators == null ? List.of() : customValidators;
        if (client != null) {
            this.client.setOidcProvider(this);
        }
    }

    public OidcProvider(String publicKeyEnc, OidcTenantConfig oidcConfig) {
        this.client = null;
        this.oidcConfig = oidcConfig;
        this.tokenCustomizer = TenantFeatureFinder.find(oidcConfig);
        if (publicKeyEnc != null) {
            this.asymmetricKeyResolver = new LocalPublicKeyResolver(publicKeyEnc);
        } else if (oidcConfig.certificateChain().trustStoreFile().isPresent()) {
            this.asymmetricKeyResolver = new CertChainPublicKeyResolver(oidcConfig);
        } else {
            throw new IllegalStateException("Neither public key nor certificate chain verification modes are enabled");
        }
        this.keyResolverProvider = null;
        this.issuer = checkIssuerProp();
        this.audience = checkAudienceProp();
        this.requiredClaims = checkRequiredClaimsProp();
        this.requiredAlgorithmConstraints = checkSignatureAlgorithm();
        this.customValidators = TenantFeatureFinder.find(oidcConfig, Validator.class);
    }

    private AlgorithmConstraints checkSignatureAlgorithm() {
        if (oidcConfig != null && oidcConfig.token().signatureAlgorithm().isPresent()) {
            String configuredAlg = oidcConfig.token().signatureAlgorithm().get().getAlgorithm();
            return new AlgorithmConstraints(AlgorithmConstraints.ConstraintType.PERMIT, configuredAlg);
        } else {
            return null;
        }
    }

View on GitHub (pinned to e1c734241f)

Solutions

1. Set quarkus.oidc.public-key=<PEM key> matching the token signing key.
2. Or set quarkus.oidc.certificate-chain.trust-store-file (and related trust-store options) for certificate chain verification.
3. Or remove local-verification-only setup and point the tenant at a real OIDC provider (auth-server-url) so keys come from JWKS.
4. Verify the config properties are on the correct tenant profile (quarkus.oidc.<tenant>.public-key).

Example fix

// before
# quarkus.oidc.public-key= (missing)
// after
quarkus.oidc.public-key=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...

if (config.publicKey().isEmpty() && config.certificateChain().trustStoreFile().isEmpty()) {
    throw new IllegalStateException("Set quarkus.oidc.public-key or certificate-chain.trust-store-file for local verification");
}

boolean canVerifyLocally(OidcTenantConfig cfg) {
    return cfg.publicKey().isPresent()
        || cfg.certificateChain().trustStoreFile().isPresent();
}

try {
    return new OidcProvider(oidcConfig, tenantResolver);
} catch (IllegalStateException e) {
    // fail fast at startup: log and abort deployment
}

When it happens

Trigger: Creating OidcProvider with oidcConfig that has neither publicKeyEnc (quarkus.oidc.public-key) nor quarkus.oidc.certificate-chain.trust-store-file set, i.e. local verification enabled without any verification key.

Common situations: Copy-pasted config where public-key line was removed; signing JWTs locally in tests without setting the key; typo in config property names so neither option resolves.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Both public key and certificate chain verification modes are
• 'public-key' property can only be used with the 'service' ap
• Application 'web-app' type is only supported if access token
• Failed to parse the realm name.
• Failed to find a matching OidcTenantConfig for tenant:

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/ab1a083c31f025e3. Report an issue: GitHub.