{"record":{"id":"037eb5a88acdcfe2","repo":"quarkusio/quarkus","slug":"no-password-provided-for-truststore","errorCode":null,"errorMessage":"No password provided for truststore","messagePattern":"No password provided for truststore","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java","lineNumber":202,"sourceCode":"            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {\n                throw new IllegalArgumentException(\"Failed to initialize trust store from classpath resource \" + keyStorePath,\n                        e);\n            }\n\n            builder.keyStore(keyStore, password);\n        } catch (KeyStoreException e) {\n            throw new IllegalArgumentException(\"Failed to initialize trust store from \" + keyStorePath, e);\n        }\n    }\n\n    private void registerTrustStore(String trustStorePath, RestClientBuilder builder) {\n        try {\n            Optional<String> trustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());\n            KeyStore trustStore = KeyStore.getInstance(trustStoreType.orElse(\"JKS\"));\n\n            Optional<String> trustStorePassword = oneOf(restClientConfig.trustStorePassword(), configRoot.trustStorePassword());\n            if (trustStorePassword.isEmpty()) {\n                throw new IllegalArgumentException(\"No password provided for truststore\");\n            }\n            String password = trustStorePassword.get();\n\n            try (InputStream input = locateStream(trustStorePath)) {\n                trustStore.load(input, password.toCharArray());\n            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {\n                throw new IllegalArgumentException(\"Failed to initialize trust store from classpath resource \" + trustStorePath,\n                        e);\n            }\n\n            builder.trustStore(trustStore);\n        } catch (KeyStoreException e) {\n            throw new IllegalArgumentException(\"Failed to initialize trust store from \" + trustStorePath, e);\n        }\n    }\n\n    private InputStream locateStream(String path) throws FileNotFoundException {\n        if (path.startsWith(\"classpath:\")) {","sourceCodeStart":184,"sourceCodeEnd":220,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java#L184-L220","documentation":"RestClientBase.registerTrustStore() throws this when building the SSL context for a MicroProfile REST client and no truststore password is configured. A JKS/PKCS12 truststore cannot be loaded without its password, so the client aborts startup with IllegalArgumentException instead of failing later with an opaque SSL error.","triggerScenarios":"quarkus.rest-client.<key>.trust-store (or trust-store-type) is set but neither quarkus.rest-client.<key>.trust-store-password nor quarkus.rest-client.<config-key>.trust-store-password is set; oneOf() finds no password in either the per-client config or the global RestClientsConfig.","commonSituations":"Copying truststore config from another project and forgetting the password property; password supplied under the wrong config key prefix; password defined only in a profile that is not active; migrating to Quarkus config where the MP property name changed.","solutions":["Set quarkus.rest-client.<key>.trust-store-password=<password> (or use the config-key variant) in application.properties","Verify the property prefix matches the @RegisterRestClient configKey or the fully-qualified interface name actually used","If the truststore truly has no password, set trust-store-password to an empty value or use a password-less store format such as PEM where supported"],"exampleFix":"// before (application.properties)\nquarkus.rest-client.metrics-api.url=https://api.example.com\nquarkus.rest-client.metrics-api.trust-store=file:/etc/certs/truststore.jks\n// after\nquarkus.rest-client.metrics-api.url=https://api.example.com\nquarkus.rest-client.metrics-api.trust-store=file:/etc/certs/truststore.jks\nquarkus.rest-client.metrics-api.trust-store-password=changeit","handlingStrategy":"validation","validationCode":"// before building the client\nConfig cfg = ConfigProvider.getConfig();\nOptional<String> store = cfg.getOptionalValue(\"quarkus.rest-client.my-client.trust-store\", String.class);\nOptional<String> pw = cfg.getOptionalValue(\"quarkus.rest-client.my-client.trust-store-password\", String.class);\nif (store.isPresent() && pw.isEmpty()) {\n    throw new IllegalStateException(\"trust-store set but trust-store-password missing for my-client\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pair trust-store with trust-store-password in the same config block/profile","Use a startup check that validates SSL properties together","Document required SSL env vars for deployments","Test client creation in CI with production-like SSL config"],"tags":["ssl","rest-client","keystore","configuration"],"backgroundTag":"missing-truststore-password","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}