quarkusio/quarkus · error · java.lang.IllegalStateException

Unable to load P12 ${type} store '${name}', verify the passw

Error message

Unable to load P12 ${type} store '${name}', verify the password.

What it means

Wraps any exception raised while loading a P12 (PKCS#12) keystore or trust store through Vert.x PfxOptions, telling the user to check the password. Quarkus TLS registry calls loadKeyStore and converts any failure (wrong password, missing file, malformed PKCS#12) into this IllegalStateException with the store's logical name and type (keystore or trust store).

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/P12KeyStores.java:158

        if (maybeAlias.isPresent()) {
            String alias = maybeAlias.get();
            try {
                if (ks.getCertificate(alias) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in P12 trust store (certificate not found)'" + name + "'");
                }
            } catch (KeyStoreException e) {
                throw new IllegalStateException("Unable to verify alias '" + alias + "' in P12 trust store '" + name + "'", e);
            }
        }
    }

    private static KeyStore loadKeyStore(Vertx vertx, String name, PfxOptions options, String type) {
        KeyStore ks;
        try {
            ks = options.loadKeyStore(vertx);
        } catch (Exception e) {
            throw new IllegalStateException("Unable to load P12 " + type + " store '" + name + "', verify the password.", e);
        }
        return ks;
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

1. Check that quarkus.tls.<name>.(key-store|trust-store).p12.password matches the actual store password
2. Verify the p12.path points to an existing, readable PKCS#12 file at runtime (absolute path to test)
3. Validate the file with keytool -list -keystore file.p12 -storetype PKCS12 -storepass <password>
4. Re-export the store correctly: keytool -importkeystore -deststoretype PKCS12

Example fix

// before
quarkus.tls.my-tls.key-store.p12.path=conf/ks.p12
quarkus.tls.my-tls.key-store.p12.password=oldpass
// after (after rotation)
quarkus.tls.my-tls.key-store.p12.path=/etc/app/certs/ks.p12
quarkus.tls.my-tls.key-store.p12.password=newpass

File f = new File(p12Path);
if (!f.isFile() || !f.canRead()) throw new IllegalStateException("Missing p12: " + p12Path);
try (InputStream in = new FileInputStream(f)) {
    KeyStore.getInstance("PKCS12").load(in, password.toCharArray()); // throws on bad password
}

try {
    // start app / use TLS config
} catch (IllegalStateException e) {
    if (e.getMessage().contains("verify the password")) {
        log.errorf(e.getCause(), "P12 store %s failed to load; check password/path", storeName);
    }
}

When it happens

Trigger: options.loadKeyStore(vertx) throws for a PfxOptions built from quarkus.tls.<name>.key-store.p12.* or trust-store.p12.* config — wrong password, unreadable path, or invalid PKCS#12 content.

Common situations: Password changed after rotation but config not updated; file path relative to a working directory that differs at runtime; base64/PEM file supplied instead of real .p12 binary; store exported with an empty password while config provides one.

Related errors

• Invalid P12 key store configuration for certificate '${name}
• Unable to recover the key for alias '${alias}' in P12 key st
• Invalid JKS key store configuration for certificate '" + nam
• Unable to load JKS ${type} store '${name}', verify the passw
• Invalid key store configuration for certificate '${name}' -

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/7fa2cfef8f7cabb4. Report an issue: GitHub.