quarkusio/quarkus · error · java.lang.IllegalStateException

Unable to create key store of type '${type}' with provider '

Error message

Unable to create key store of type '${type}' with provider '${provider}'

What it means

Thrown by OtherKeyStores.getInstance (used by the ks loader) when KeyStore.getInstance(type, provider) fails for a non-default store type/provider — i.e. the JVM/security providers cannot construct a KeyStore of the requested type, typically an unknown or unsupported type string or an unavailable provider name. The wrapper names both the requested type and provider so the misconfiguration is identifiable.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java:134

            }
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid trust store configuration for certificate '" + name
                    + "' - cannot read the trust store file '" + config.path().get() + "'", e);
        } catch (IllegalStateException | IllegalArgumentException e) {
            throw e;
        } catch (Exception e) {
            throw new IllegalStateException("Invalid trust store configuration for certificate '" + name + "'", e);
        }
    }

    private static KeyStore getInstance(String type, Optional<String> provider) {
        try {
            if (provider.isPresent()) {
                return KeyStore.getInstance(type, provider.get());
            }
            return KeyStore.getInstance(type);
        } catch (KeyStoreException | NoSuchProviderException e) {
            throw new IllegalStateException("Unable to create key store of type '" + type + "'"
                    + (provider.isPresent() ? " with provider '" + provider.get() + "'" : ""), e);
        }
    }

    private static void verifyKeyStoreAlias(OtherKeyStoreConfig config, String name, KeyStore ks,
            String aliasPassword) {
        if (config.alias().isPresent()) {
            String alias = config.alias().get();
            try {
                if (ks.getCertificate(alias) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in key store (certificate not found) '" + name + "'");
                }
            } catch (KeyStoreException e) {
                throw new IllegalStateException("Unable to verify alias '" + alias + "' in key store '" + name + "'", e);
            }

            char[] ap = aliasPassword != null ? aliasPassword.toCharArray() : null;

View on GitHub (pinned to e1c734241f)

Solutions

1. Correct the quarkus.tls.key-store.other.type value (e.g. PKCS12, JKS)
2. If provider set, register it first (Security.addProvider) or drop quarkus.tls.key-store.other.provider
3. Use a type supported in native image (PKCS12/JKS)

Example fix

# before
quarkus.tls.key-store.other.type=pkcs_12
quarkus.tls.key-store.other.provider=BC
# after
quarkus.tls.key-store.other.type=PKCS12

try { java.security.KeyStore.getInstance(type); } catch (KeyStoreException e) {
    throw new IllegalArgumentException("Unsupported keystore type: " + type);
}

try { init(); } catch (IllegalStateException e) {
    if (e.getMessage().startsWith("Unable to create key store")) { log.error("Check type/provider availability in this JVM"); }
    throw e;
}

When it happens

Trigger: getInstance(type, provider) called with a type string no installed provider supports, or a provider name not registered in the JDK.

Common situations: Typo like 'pkcs11' vs 'PKCS11'; referencing BouncyCastle provider not registered; custom type on a restricted JVM (native image).

Related errors

• Failed to load keystore
• Failed to initialize trust store from ${trustStorePath}
• No password provided for keystore
• Failed to initialize trust store from classpath resource " +
• Failed to initialize trust store from " + keyStorePath

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/9c6f210b816db5d2. Report an issue: GitHub.