quarkusio/quarkus · error · IllegalStateException

The trust-all option cannot be used when a trust-store is co

Error message

The trust-all option cannot be used when a trust-store is configured

What it means

verifyCertificateConfigInternal() rejects configurations that combine quarkus.tls.trust-all=true with an explicit trust-store, since the two are contradictory: trust-all disables certificate validation entirely while a trust-store defines which CAs to trust. Thrown as IllegalStateException so the misconfiguration is caught at startup rather than silently ignoring the trust-store.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/CertificateRecorder.java:121

        // Handle reloading if needed
        if (config.reloadPeriod().isPresent()) {
            if (reloader == null) {
                reloader = new TlsCertificateUpdater(vertx);
            }
            reloader.add(name, certificates.get(name), config.reloadPeriod().get());
        }
    }

    private static TlsConfiguration verifyCertificateConfigInternal(TlsBucketConfig config, Vertx vertx, String name) {
        // Verify the key store
        KeyStoreAndKeyCertOptions ks = getKeyStore(config, vertx, name);

        // Verify the trust store
        TrustStoreAndTrustOptions ts = getTrustStore(config, vertx, name);

        if (config.trustAll() && ts != null) {
            throw new IllegalStateException("The trust-all option cannot be used when a trust-store is configured");
        } else if (config.trustAll()) {
            LOGGER.warnf("TLS certificate validation disabled via trust-all configuration - name: %s", name);
            LOGGER.warn("This configuration is INSECURE and must not be used in production");
            ts = new TrustStoreAndTrustOptions(null, TrustAllOptions.INSTANCE);
        }
        return new VertxCertificateHolder(vertx, name, config, ks, ts);
    }

    public static KeyStoreAndKeyCertOptions getKeyStore(TlsBucketConfig bucketConfig, Vertx vertx, String name) {
        try (var providerInstance = lookupProvider(KeyStoreProvider.class, name)) {
            if (bucketConfig.keyStore().isPresent()) {
                var config = bucketConfig.keyStore().get();

                config.validate(providerInstance, name);

                if (config.pem().isPresent()) {
                    return PemKeyStores.verifyPEMKeyStore(config, vertx, name);
                } else if (config.p12().isPresent()) {

View on GitHub (pinned to e1c734241f)

Solutions

Set quarkus.tls.trust-all=false (or remove it) now that a trust-store is configured
Remove the trust-store properties if insecure trust-all behavior is truly intended (dev only)
Use Quarkus profiles so trust-all only applies in dev/test, never in prod

Example fix

// before
quarkus.tls.trust-all=true
quarkus.tls.trust-store.paths=trust/cacerts.jks
// after
quarkus.tls.trust-all=false
quarkus.tls.trust-store.paths=trust/cacerts.jks

Defensive patterns

Strategy: validation

Validate before calling

if (config.trustAll() && (config.trustStore() != null
        && (config.trustStore().paths().isPresent() || config.trustStore().certs().isPresent()))) {
    throw new IllegalStateException("trust-all cannot be combined with a trust-store");
}

Try / catch

try {
    // start application with TLS config
} catch (IllegalStateException e) {
    if (e.getMessage().contains("trust-all")) {
        log.error("Disable trust-all or remove the trust-store", e);
    } else { throw e; }
}

Prevention

Remove trust-all=true before adding a trust-store to any profile
Keep trust-all only in dev/test profiles; never in prod
Audit merged config fragments for contradictory TLS trust settings

When it happens

Trigger: A TLS config bucket sets both trust-all=true and a trust-store (quarkus.tls.trust-store.* paths/certs), or an extension config merges trustAll with a programmatically provided trust store.

Common situations: Leaving trust-all=true in from a dev/test profile when adding a real trust-store for production; combining shared config fragments where one sets trust-all and another sets trust-store; misunderstanding that trust-store takes precedence.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/05e67e14a4b8de39. Report an issue: GitHub.