{"record":{"id":"b0604f76a36ddfbf","repo":"quarkusio/quarkus","slug":"failed-to-load-truststore","errorCode":null,"errorMessage":"Failed to load truststore","messagePattern":"Failed to load truststore","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/keycloak-authorization/runtime/src/main/java/io/quarkus/keycloak/pep/runtime/HttpClientBuilder.java","lineNumber":427,"sourceCode":"\n            }\n            return clientBuilder.build();\n        } catch (Exception e) {\n            throw new RuntimeException(e);\n        }\n    }\n\n    public HttpClient build(AdapterHttpClientConfig adapterConfig) {\n        disableCookieCache(true); // disable cookie cache as we don't want sticky sessions for load balancing\n\n        String truststorePath = adapterConfig.getTruststore();\n        if (truststorePath != null) {\n            truststorePath = EnvUtil.replace(truststorePath);\n            String truststorePassword = adapterConfig.getTruststorePassword();\n            try {\n                this.truststore = KeystoreUtil.loadKeyStore(truststorePath, truststorePassword);\n            } catch (Exception e) {\n                throw new RuntimeException(\"Failed to load truststore\", e);\n            }\n        }\n        String clientKeystore = adapterConfig.getClientKeystore();\n        if (clientKeystore != null) {\n            clientKeystore = EnvUtil.replace(clientKeystore);\n            String clientKeystorePassword = adapterConfig.getClientKeystorePassword();\n            try {\n                KeyStore clientCertKeystore = KeystoreUtil.loadKeyStore(clientKeystore, clientKeystorePassword);\n                keyStore(clientCertKeystore, clientKeystorePassword);\n            } catch (Exception e) {\n                throw new RuntimeException(\"Failed to load keystore\", e);\n            }\n        }\n\n        HttpClientBuilder.HostnameVerificationPolicy policy = HttpClientBuilder.HostnameVerificationPolicy.WILDCARD;\n        if (adapterConfig.isAllowAnyHostname())\n            policy = HttpClientBuilder.HostnameVerificationPolicy.ANY;\n        connectionPoolSize(adapterConfig.getConnectionPoolSize());","sourceCodeStart":409,"sourceCodeEnd":445,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/keycloak-authorization/runtime/src/main/java/io/quarkus/keycloak/pep/runtime/HttpClientBuilder.java#L409-L445","documentation":"Thrown during HttpClientBuilder.build() when KeystoreUtil.loadKeyStore cannot load the configured truststore file (wrong path, wrong password, unreadable file, or invalid format). The original exception is wrapped in a RuntimeException so client construction fails fast.","triggerScenarios":"AdapterConfig has a truststore path set (e.g. quarkus.oidc.tls.trust-store-file / adapter truststore config) but the file does not exist at runtime, the truststore password is wrong, or the file is not a loadable keystore (JKS/PKCS12 mismatch or corrupt).","commonSituations":"Container image missing the mounted truststore file; path uses a container-invisible location; password changed on the keystore; certificate exported in PEM instead of a keystore format; env-var substitution (EnvUtil.replace) yields an unexpected path.","solutions":["Verify the truststore file exists at the configured path inside the runtime environment (ls the exact resolved path, including env-substituted values).","Confirm the truststore password matches the keystore's password.","Check the keystore format: create it with keytool -importcert -file ca.crt -keystore truststore.jks (or .p12 with -storetype PKCS12) and match the configured type.","Ensure the file is readable by the process user and is included in the container image/volume mount."],"exampleFix":"// before\nkeytool -importcert -file ca.pem -keystore truststore\n# password mismatch, path wrong -> Failed to load truststore\n// after\nkeytool -importcert -alias keycloak-ca -file ca.pem -keystore truststore.jks -storepass changeit -noprompt\nquarkus.oidc.tls.trust-store-file=/opt/certs/truststore.jks\nquarkus.oidc.tls.trust-store-password=changeit","handlingStrategy":"validation","validationCode":"File ts = new File(resolvedTruststorePath);\nif (!ts.isFile() || !ts.canRead())\n    throw new IllegalStateException(\"Truststore missing/unreadable: \" + ts.getAbsolutePath());\n// password check: try loading before startup\nKeyStore ks = KeyStore.getInstance(\"JKS\");\ntry (InputStream in = new FileInputStream(ts)) { ks.load(in, truststorePassword.toCharArray()); }","typeGuard":null,"tryCatchPattern":"try {\n    HttpClientBuilder hb = HttpClientBuilder.create(adapterConfig);\n    client = hb.build();\n} catch (RuntimeException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"Failed to load truststore\")) {\n        log.error(\"Check truststore path/password/format: {}\", adapterConfig.getTruststore(), e.getCause());\n    }\n    throw e;\n}","preventionTips":["Verify the truststore path exists inside the deployment container, not just on your dev machine.","Keep truststore password in sync with the keystore (rotation checklist).","Generate truststores with keytool in a supported format (JKS/PKCS12), not raw PEM.","Smoke-test startup with the truststore mounted before shipping the image."],"tags":["tls","truststore","configuration","keycloak"],"backgroundTag":"truststore-load-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}