{"record":{"id":"3838d4e8590fac35","repo":"quarkusio/quarkus","slug":"no-password-provided-for-truststore-3838d4","errorCode":null,"errorMessage":"No password provided for truststore","messagePattern":"No password provided for truststore","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java","lineNumber":338,"sourceCode":"                throw new IllegalArgumentException(\"Failed to initialize trust store from classpath resource \" + keyStorePath,\n                        e);\n            }\n\n            builder.keyStore(keyStore, password);\n        } catch (KeyStoreException e) {\n            throw new IllegalArgumentException(\"Failed to initialize trust store from \" + keyStorePath, e);\n        }\n    }\n\n    private void registerTrustStore(String trustStorePath, QuarkusRestClientBuilder builder) {\n        Optional<String> maybeTrustStorePassword = oneOf(restClientConfig.trustStorePassword(),\n                configRoot.trustStorePassword());\n        Optional<String> maybeTrustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());\n\n        try {\n            KeyStore trustStore = KeyStore.getInstance(maybeTrustStoreType.orElse(\"JKS\"));\n            if (maybeTrustStorePassword.isEmpty()) {\n                throw new IllegalArgumentException(\"No password provided for truststore\");\n            }\n            String password = maybeTrustStorePassword.get();\n\n            try (InputStream input = locateStream(trustStorePath)) {\n                trustStore.load(input, password.toCharArray());\n            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {\n                throw new IllegalArgumentException(\"Failed to initialize trust store from classpath resource \" + trustStorePath,\n                        e);\n            }\n\n            builder.trustStore(trustStore, password);\n        } catch (KeyStoreException e) {\n            throw new IllegalArgumentException(\"Failed to initialize trust store from \" + trustStorePath, e);\n        }\n    }\n\n    private InputStream locateStream(String path) throws FileNotFoundException {\n        if (path.startsWith(\"classpath:\")) {","sourceCodeStart":320,"sourceCodeEnd":356,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java#L320-L356","documentation":"RestClientCDIDelegateBuilder.registerTrustStore requires a password when loading a trust store and throws IllegalArgumentException if neither quarkus.rest-client.<key>.trust-store-password nor the global quarkus.restclient.trust-store-password property is set. Unlike a java.net.ssl context where truststore passwords are often ignored, this builder passes the password to KeyStore.load, so it treats a missing password as a hard configuration error.","triggerScenarios":"Creating a @RegisterRestClient client (or calling QuarkusRestClientBuilder manually routed through configureTLSFromProperties) with trust-store and trust-store-type configured but no trust-store-password property present in either the per-client or global quarkus.restclient scope.","commonSituations":"Assuming PKCS12 trust stores can omit the password (JDK validates integrity, so a password is needed); the property was defined under a wrong prefix (e.g. quarkus.rest-client.\"my-client\" quoting/typo mismatch so the per-client value isn't picked up); config moved to environment variables whose name doesn't map (dots to underscores).","solutions":["Add quarkus.rest-client.<key>.trust-store-password (or quarkus.restclient.trust-store-password globally) with the actual truststore password","If the truststore genuinely has no integrity password, create the file with keytool and a known password (PKCS12/JKS require one on load here)","Check SmallRye config logs / dev mode config editor to confirm the property name matches the client config key exactly","If a password is truly unavailable, load the trust store yourself in code and call builder.trustStore with the certificates instead of using config-based registration"],"exampleFix":"// before\nquarkus.rest-client.my-client.trust-store=file:certs/truststore.p12\n// after\nquarkus.rest-client.my-client.trust-store=file:certs/truststore.p12\nquarkus.rest-client.my-client.trust-store-password=changeit","handlingStrategy":"validation","validationCode":"var cfg = ConfigProvider.getConfig();\nvar pw = cfg.getOptionalValue(\"quarkus.rest-client.my-client.trust-store-password\", String.class)\n        .or(() -> cfg.getOptionalValue(\"quarkus.restclient.trust-store-password\", String.class));\nif (pw.isEmpty()) {\n    throw new ConfigurationException(\n        \"quarkus.rest-client.my-client.trust-store-password is required when a trust-store is configured\");\n}","typeGuard":"static boolean hasTrustStorePassword(org.eclipse.microprofile.config.Config config, String clientKey) {\n    return config.getOptionalValue(\"quarkus.rest-client.\" + clientKey + \".trust-store-password\", String.class).isPresent()\n        || config.getOptionalValue(\"quarkus.restclient.trust-store-password\", String.class).isPresent();\n}","tryCatchPattern":"try {\n    return clientFactory.create(MyClient.class);\n} catch (IllegalArgumentException e) {\n    if (\"No password provided for truststore\".equals(e.getMessage())) {\n        throw new ConfigurationException(\n            \"Set quarkus.rest-client.<key>.trust-store-password (trust stores need a password here even if load-only)\", e);\n    }\n    throw e;\n}","preventionTips":["Whenever you add trust-store or trust-store-type, add trust-store-password in the same commit","Supply the password via env var (QUARKUS_REST_CLIENT_MY_CLIENT_TRUST_STORE_PASSWORD) so it survives CI/CD templating","Verify property names against the Quarkus config reference — per-client keys must match the @RegisterRestClient configKey exactly","Remember this builder requires a password even for trust stores that other SSL stacks load without one"],"tags":["tls","truststore","configuration","rest-client"],"backgroundTag":"missing-truststore-password","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}