{"record":{"id":"700115cef421241a","repo":"quarkusio/quarkus","slug":"failed-to-initialize-trust-store-from-keystorepa","errorCode":null,"errorMessage":"Failed to initialize trust store from ${keyStorePath}","messagePattern":"Failed to initialize trust store from (.+?)","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java","lineNumber":191,"sourceCode":"            Optional<String> keyStoreType = oneOf(restClientConfig.keyStoreType(), configRoot.keyStoreType());\n            KeyStore keyStore = KeyStore.getInstance(keyStoreType.orElse(\"JKS\"));\n\n            Optional<String> keyStorePassword = oneOf(restClientConfig.keyStorePassword(), configRoot.keyStorePassword());\n            if (keyStorePassword.isEmpty()) {\n                throw new IllegalArgumentException(\"No password provided for keystore\");\n            }\n            String password = keyStorePassword.get();\n\n            try (InputStream input = locateStream(keyStorePath)) {\n                keyStore.load(input, password.toCharArray());\n            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {\n                throw new IllegalArgumentException(\"Failed to initialize trust store from classpath resource \" + keyStorePath,\n                        e);\n            }\n\n            builder.keyStore(keyStore, password);\n        } catch (KeyStoreException e) {\n            throw new IllegalArgumentException(\"Failed to initialize trust store from \" + keyStorePath, e);\n        }\n    }\n\n    private void registerTrustStore(String trustStorePath, RestClientBuilder builder) {\n        try {\n            Optional<String> trustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());\n            KeyStore trustStore = KeyStore.getInstance(trustStoreType.orElse(\"JKS\"));\n\n            Optional<String> trustStorePassword = oneOf(restClientConfig.trustStorePassword(), configRoot.trustStorePassword());\n            if (trustStorePassword.isEmpty()) {\n                throw new IllegalArgumentException(\"No password provided for truststore\");\n            }\n            String password = trustStorePassword.get();\n\n            try (InputStream input = locateStream(trustStorePath)) {\n                trustStore.load(input, password.toCharArray());\n            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {\n                throw new IllegalArgumentException(\"Failed to initialize trust store from classpath resource \" + trustStorePath,","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java#L173-L209","documentation":"KeyStore.getInstance(...) or related keystore setup operations threw a KeyStoreException while registering the client keystore, so the keystore could not be initialized from the configured path. Unlike error 1818 (load failure), this happens before/outside the stream load, typically because the requested keystore type is not supported by any provider.","triggerScenarios":"registerKeyStore called with a keystore-type config value for which no JCA provider exists (KeyStoreException from KeyStore.getInstance), when building the KeyStore before reading the file.","commonSituations":"Typo in keystore-type (e.g. 'JKS ' with whitespace, 'PKCS1'); using a type requiring a provider (e.g. BCFKS) without the provider registered/dependency present; running on a JVM lacking that keystore implementation.","solutions":["Correct the quarkus.rest-client.<name>.keystore-type value to a supported type (JKS, PKCS12)","Register the required JCA security provider or add its dependency (e.g. BouncyCastle for BCFKS)","Check the JVM/security provider configuration (java.security file) supports the requested type"],"exampleFix":"# before\nquarkus.rest-client.my-client.keystore-type=PKCS1\n# after\nquarkus.rest-client.my-client.keystore-type=PKCS12","handlingStrategy":"validation","validationCode":"try {\n    KeyStore.getInstance(keystoreType != null ? keystoreType : \"JKS\");\n} catch (KeyStoreException e) {\n    throw new IllegalStateException(\"Unsupported keystore type: \" + keystoreType);\n}","typeGuard":null,"tryCatchPattern":"try {\n    // create rest client\n} catch (IllegalArgumentException e) {\n    if (e.getCause() instanceof KeyStoreException) {\n        log.error(\"Unsupported keystore type — check keystore-type config and security providers\");\n    }\n}","preventionTips":["Use standard types (JKS, PKCS12) unless a specific provider is configured","Register extra JCA providers (e.g. BouncyCastle) if using their keystore formats","Avoid whitespace/case typos in keystore-type values"],"tags":["restclient","ssl","keystore"],"backgroundTag":"unsupported-keystore-type","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}