{"record":{"id":"37399b05169f08c6","repo":"quarkusio/quarkus","slug":"certificate-file-path-not-found-for-microprofi","errorCode":null,"errorMessage":"Certificate file: ${path} not found for MicroProfile Rest Client SSL configuration","messagePattern":"Certificate file: (.+?) not found for MicroProfile Rest Client SSL configuration","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java","lineNumber":237,"sourceCode":"    private InputStream locateStream(String path) throws FileNotFoundException {\n        if (path.startsWith(\"classpath:\")) {\n            path = path.replaceFirst(\"classpath:\", \"\");\n            InputStream resultStream = Thread.currentThread().getContextClassLoader().getResourceAsStream(path);\n            if (resultStream == null) {\n                resultStream = getClass().getResourceAsStream(path);\n            }\n            if (resultStream == null) {\n                throw new IllegalArgumentException(\n                        \"Classpath resource \" + path + \" not found for MicroProfile Rest Client SSL configuration\");\n            }\n            return resultStream;\n        } else {\n            if (path.startsWith(\"file:\")) {\n                path = path.replaceFirst(\"file:\", \"\");\n            }\n            File certificateFile = new File(path);\n            if (!certificateFile.isFile()) {\n                throw new IllegalArgumentException(\n                        \"Certificate file: \" + path + \" not found for MicroProfile Rest Client SSL configuration\");\n            }\n            return new FileInputStream(certificateFile);\n        }\n    }\n\n    protected void configureProviders(RestClientBuilder builder) {\n        Optional<String> providers = oneOf(restClientConfig.providers(), configRoot.providers());\n        if (providers.isPresent()) {\n            registerProviders(builder, providers.get());\n        }\n        if (clientProviders != null) {\n            for (Class<?> annotationProvider : clientProviders) {\n                builder.register(annotationProvider);\n            }\n        }\n    }\n","sourceCodeStart":219,"sourceCodeEnd":255,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java#L219-L255","documentation":"locateStream() handles non-classpath paths as filesystem paths (after stripping an optional file: prefix). When new File(path).isFile() is false it throws this IllegalArgumentException — the certificate/keystore file does not exist or is a directory at that location.","triggerScenarios":"quarkus.rest-client.<key>.trust-store or keystore is a plain path or file:/path value whose target is missing, deleted at startup, or a directory; container image built without the cert file being COPYed in.","commonSituations":"Kubernetes volume not mounted or mounted at a different path; secret name mismatch in the deployment YAML; relative path interpreted against a different working directory in the container; cert generated at runtime after the client is built.","solutions":["Confirm the absolute path exists inside the runtime container: ls -l /etc/certs/truststore.jks via an exec into the pod/image","Fix the mount: ensure the volume/secret is mounted at the configured path in deployment manifests","Use absolute file: paths instead of relative ones to remove working-directory ambiguity","If the file is generated at startup, generate it before the REST client bean is created (init container or eager observer)"],"exampleFix":"// before (application.properties)\nquarkus.rest-client.shipping.trust-store=truststore.jks\n// after\nquarkus.rest-client.shipping.trust-store=file:/etc/certs/truststore.jks\n// and ensure: COPY truststore.jks /etc/certs/ in the Dockerfile","handlingStrategy":"validation","validationCode":"// check the file before configuring the client\nPath p = Path.of(\"/etc/certs/truststore.jks\");\nif (!Files.isRegularFile(p) || !Files.isReadable(p)) {\n    throw new IllegalStateException(\"Certificate file missing/unreadable: \" + p);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use absolute file: paths in container deployments","Verify volume/secret mounts with a startup readiness check (ls the mount path)","COPY certs into the image rather than relying on runtime-only generation when possible","Prefer mounting secrets read-only at fixed, documented paths"],"tags":["filesystem","ssl","certificate","container"],"backgroundTag":"certificate-file-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}