{"record":{"id":"b1339100329dbca0","repo":"quarkusio/quarkus","slug":"no-password-provided-for-keystore","errorCode":null,"errorMessage":"No password provided for keystore","messagePattern":"No password provided for keystore","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java","lineNumber":178,"sourceCode":"        } catch (InstantiationException | IllegalAccessException | InvocationTargetException e) {\n            throw new RuntimeException(\n                    \"Failed to instantiate hostname verifier class \" + verifier\n                            + \". Make sure it has a public, no-argument constructor\",\n                    e);\n        } catch (ClassCastException e) {\n            throw new RuntimeException(\"The provided hostname verifier \" + verifier + \" is not an instance of HostnameVerifier\",\n                    e);\n        }\n    }\n\n    private void registerKeyStore(String keyStorePath, RestClientBuilder builder) {\n        try {\n            Optional<String> keyStoreType = oneOf(restClientConfig.keyStoreType(), configRoot.keyStoreType());\n            KeyStore keyStore = KeyStore.getInstance(keyStoreType.orElse(\"JKS\"));\n\n            Optional<String> keyStorePassword = oneOf(restClientConfig.keyStorePassword(), configRoot.keyStorePassword());\n            if (keyStorePassword.isEmpty()) {\n                throw new IllegalArgumentException(\"No password provided for keystore\");\n            }\n            String password = keyStorePassword.get();\n\n            try (InputStream input = locateStream(keyStorePath)) {\n                keyStore.load(input, password.toCharArray());\n            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {\n                throw new IllegalArgumentException(\"Failed to initialize trust store from classpath resource \" + keyStorePath,\n                        e);\n            }\n\n            builder.keyStore(keyStore, password);\n        } catch (KeyStoreException e) {\n            throw new IllegalArgumentException(\"Failed to initialize trust store from \" + keyStorePath, e);\n        }\n    }\n\n    private void registerTrustStore(String trustStorePath, RestClientBuilder builder) {\n        try {","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java#L160-L196","documentation":"When a key store path is configured for a REST client, RestClientBase reads the keystore password from config and requires it to be present. This IllegalArgumentException is thrown when neither the rest-client-specific nor the global keystore password config property is set. Without the password the KeyStore cannot be loaded.","triggerScenarios":"Configuring quarkus.rest-client.<name>.keystore-path (or keystore config) without setting quarkus.rest-client.<name>.keystore-password (or the global rest-client keystore-password).","commonSituations":"Setting the keystore path but forgetting the password property; password provided under a differently-named/older config key; using an env/secret source that didn't resolve so the Optional came back empty.","solutions":["Set quarkus.rest-client.<name>.keystore-password (or %env profile equivalent) alongside keystore-path","Supply the password via an environment variable or credentials provider instead of hardcoding","Double-check the exact config key spelling for your Quarkus version"],"exampleFix":"# before\nquarkus.rest-client.my-client.keystore-path=certs/client.jks\n# after\nquarkus.rest-client.my-client.keystore-path=certs/client.jks\nquarkus.rest-client.my-client.keystore-password=changeit","handlingStrategy":"validation","validationCode":"if (config.keystorePath().isPresent() && config.keystorePassword().isEmpty()) {\n    throw new IllegalStateException(\"keystore-path is set but keystore-password is missing\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    // client creation\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"No password provided for keystore\")) {\n        log.error(\"Set quarkus.rest-client.<name>.keystore-password\");\n    }\n}","preventionTips":["Always pair keystore-path with keystore-password in config templates","Inject secrets via environment variables or Quarkus credentials providers","Validate required config at startup with a config-mapping sanity check"],"tags":["restclient","ssl","configuration"],"backgroundTag":"missing-config-property","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}