quarkusio/quarkus · critical · ConfigurationException

Truststore with configured password which keeps thumbprints

Error message

Truststore with configured password which keeps thumbprints of the trusted certificates must be present

What it means

Quarkus OIDC throws this ConfigurationException at startup when a tenant is configured with certificate-chain-bound token verification (quarkus.oidc.certificate-chain.*) but no truststore password is set. The CertChainPublicKeyResolver needs the password to load the truststore and compute thumbprints of trusted certificates. Without it, certificate chain verification cannot work, so configuration is rejected immediately.

Source

Thrown at extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CertChainPublicKeyResolver.java:30

import org.jose4j.lang.UnresolvableKeyException;

import io.quarkus.oidc.OidcTenantConfig;
import io.quarkus.oidc.TokenCertificateValidator;
import io.quarkus.runtime.configuration.ConfigurationException;
import io.quarkus.vertx.http.runtime.security.HttpSecurityUtils;
import io.vertx.ext.auth.impl.CertificateHelper;

public class CertChainPublicKeyResolver implements RefreshableVerificationKeyResolver {
    private static final Logger LOG = Logger.getLogger(OidcProvider.class);
    final OidcTenantConfig oidcConfig;
    final Set<String> thumbprints;
    final Optional<String> expectedLeafCertificateName;
    final List<TokenCertificateValidator> certificateValidators;

    public CertChainPublicKeyResolver(OidcTenantConfig oidcConfig) {
        this.oidcConfig = oidcConfig;
        if (oidcConfig.certificateChain().trustStorePassword().isEmpty()) {
            throw new ConfigurationException(
                    "Truststore with configured password which keeps thumbprints of the trusted certificates must be present");
        }
        this.thumbprints = TrustStoreUtils.getTrustedCertificateThumbprints(
                oidcConfig.certificateChain().trustStoreFile().get(),
                oidcConfig.certificateChain().trustStorePassword().get(),
                oidcConfig.certificateChain().trustStoreCertAlias(),
                oidcConfig.certificateChain().trustStoreFileType());
        this.expectedLeafCertificateName = oidcConfig.certificateChain().leafCertificateName();
        this.certificateValidators = TenantFeatureFinder.find(oidcConfig, TokenCertificateValidator.class);
    }

    @Override
    public Key resolveKey(JsonWebSignature jws, List<JsonWebStructure> nestingContext)
            throws UnresolvableKeyException {

        try {
            List<X509Certificate> chain = jws.getCertificateChainHeaderValue();
            if (chain == null) {

View on GitHub (pinned to e1c734241f)

Solutions

Set quarkus.oidc.certificate-chain.trust-store-password=<password> (or the tenant-scoped equivalent) in application.properties.
If configuring programmatically, set certificateChain().trustStorePassword() to a non-empty value in the OidcTenantConfig builder.
Verify the password is actually injected (env var, secret) and not left empty at build time.

Example fix

// before
quarkus.oidc.tenant-a.certificate-chain.trust-store-file=/conf/truststore.p12
// after
quarkus.oidc.tenant-a.certificate-chain.trust-store-file=/conf/truststore.p12
quarkus.oidc.tenant-a.certificate-chain.trust-store-password=secret

Defensive patterns

Strategy: validation

Validate before calling

if (config.certificateChain().trustStoreFile().isPresent()
        && config.certificateChain().trustStorePassword().isEmpty()) {
    throw new IllegalStateException(
        "certificate-chain.trust-store-file requires certificate-chain.trust-store-password");
}

Try / catch

try {
    startApplication();
} catch (ConfigurationException e) {
    if (e.getMessage().contains("Truststore with configured password")) {
        log.error("OIDC certificate-chain truststore password missing; set quarkus.oidc.certificate-chain.trust-store-password");
    }
    throw e;
}

Prevention

Always set trust-store-password together with trust-store-file in the same config block.
Add a startup smoke test or CI config check that builds the tenant config.
Use a config profile and assert required OIDC properties exist before deploy.

When it happens

Trigger: Tenant config sets quarkus.oidc.certificate-chain.trust-store-file (or a trustStoreFile is programmatically provided) but quarkus.oidc.certificate-chain.trust-store-password is empty/unset; OidcConfigurationConfigBuilder constructs CertChainPublicKeyResolver(oidcConfig).

Common situations: Copying a truststore config example and omitting the password property; building OidcTenantConfig programmatically and leaving trustStorePassword() as Optional.empty(); secrets injection (env var/K8s secret) not wired so the property resolves empty.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/835544ef33457367. Report an issue: GitHub.