{"record":{"id":"81b495101f5e4fa0","repo":"quarkusio/quarkus","slug":"failed-to-initialize-trust-store-from-classpath-re-81b495","errorCode":null,"errorMessage":"Failed to initialize trust store from classpath resource ${trustStorePath}","messagePattern":"Failed to initialize trust store from classpath resource (.+?)","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java","lineNumber":209,"sourceCode":"            throw new IllegalArgumentException(\"Failed to initialize trust store from \" + keyStorePath, e);\n        }\n    }\n\n    private void registerTrustStore(String trustStorePath, RestClientBuilder builder) {\n        try {\n            Optional<String> trustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());\n            KeyStore trustStore = KeyStore.getInstance(trustStoreType.orElse(\"JKS\"));\n\n            Optional<String> trustStorePassword = oneOf(restClientConfig.trustStorePassword(), configRoot.trustStorePassword());\n            if (trustStorePassword.isEmpty()) {\n                throw new IllegalArgumentException(\"No password provided for truststore\");\n            }\n            String password = trustStorePassword.get();\n\n            try (InputStream input = locateStream(trustStorePath)) {\n                trustStore.load(input, password.toCharArray());\n            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {\n                throw new IllegalArgumentException(\"Failed to initialize trust store from classpath resource \" + trustStorePath,\n                        e);\n            }\n\n            builder.trustStore(trustStore);\n        } catch (KeyStoreException e) {\n            throw new IllegalArgumentException(\"Failed to initialize trust store from \" + trustStorePath, e);\n        }\n    }\n\n    private InputStream locateStream(String path) throws FileNotFoundException {\n        if (path.startsWith(\"classpath:\")) {\n            path = path.replaceFirst(\"classpath:\", \"\");\n            InputStream resultStream = Thread.currentThread().getContextClassLoader().getResourceAsStream(path);\n            if (resultStream == null) {\n                resultStream = getClass().getResourceAsStream(path);\n            }\n            if (resultStream == null) {\n                throw new IllegalArgumentException(","sourceCodeStart":191,"sourceCodeEnd":227,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java#L191-L227","documentation":"registerTrustStore() located the truststore stream and called KeyStore.load(), but loading failed with IOException, CertificateException, or NoSuchAlgorithmException. Quarkus wraps the cause in an IllegalArgumentException naming the classpath resource path, meaning the file was found but its content or format is wrong for the declared store type.","triggerScenarios":"trust-store path uses the classpath: scheme, the stream resolves, but trustStore.load() fails — corrupted/truncated file, wrong password, or trust-store-type (e.g. JKS vs PKCS12) does not match the actual file format.","commonSituations":"A PEM certificate copied into a .jks-named file while type defaults to JKS; store exported with a different password than configured; resource filtered/mangled by Maven resource filtering; wrong file accidentally placed at that classpath location.","solutions":["Check the wrapped cause (IOException/CertificateException) to distinguish wrong password from wrong format","Set quarkus.rest-client.<key>.trust-store-type=PKCS12 if the file is PKCS12, or re-export the store as JKS","Confirm the file is a real keystore: keytool -list -keystore <file> -storetype <type>","Disable Maven resource filtering for binary keystore files (maven-resources-plugin filtering=false on binaries)"],"exampleFix":"// before (application.properties)\nquarkus.rest-client.external-api.trust-store=classpath:certs/trust.pem\n// after — declare the correct type or convert the file\nquarkus.rest-client.external-api.trust-store=classpath:certs/truststore.p12\nquarkus.rest-client.external-api.trust-store-type=PKCS12\nquarkus.rest-client.external-api.trust-store-password=changeit","handlingStrategy":"validation","validationCode":"// verify the store loads before configuring the client\ntry (InputStream in = getClass().getResourceAsStream(\"/certs/truststore.p12\")) {\n    KeyStore ks = KeyStore.getInstance(\"PKCS12\");\n    ks.load(in, \"changeit\".toCharArray()); // fails early, at startup, with the real cause\n} catch (Exception e) {\n    throw new IllegalStateException(\"Bad truststore: \" + e.getMessage(), e);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run keytool -list against every keystore committed to the repo","Match trust-store-type exactly to the file format (JKS vs PKCS12)","Exclude binary keystores from Maven/Gradle resource filtering","Keep store passwords in the same secret store as the file itself"],"tags":["ssl","keystore","rest-client","classpath"],"backgroundTag":"keystore-load-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}