{"record":{"id":"b2a4810af4fa95a5","repo":"quarkusio/quarkus","slug":"failed-to-initialize-trust-store-from-classpath-re-b2a481","errorCode":null,"errorMessage":"Failed to initialize trust store from classpath resource \" + keyStorePath","messagePattern":"Failed to initialize trust store from classpath resource \" \\+ keyStorePath","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java","lineNumber":320,"sourceCode":"                    e);\n        }\n    }\n\n    private void registerKeyStore(String keyStorePath, QuarkusRestClientBuilder builder) {\n        Optional<String> keyStorePassword = oneOf(restClientConfig.keyStorePassword(), configRoot.keyStorePassword());\n        Optional<String> keyStoreType = oneOf(restClientConfig.keyStoreType(), configRoot.keyStoreType());\n\n        try {\n            KeyStore keyStore = KeyStore.getInstance(keyStoreType.orElse(\"JKS\"));\n            if (keyStorePassword.isEmpty()) {\n                throw new IllegalArgumentException(\"No password provided for keystore\");\n            }\n            String password = keyStorePassword.get();\n\n            try (InputStream input = locateStream(keyStorePath)) {\n                keyStore.load(input, password.toCharArray());\n            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {\n                throw new IllegalArgumentException(\"Failed to initialize trust store from classpath resource \" + keyStorePath,\n                        e);\n            }\n\n            builder.keyStore(keyStore, password);\n        } catch (KeyStoreException e) {\n            throw new IllegalArgumentException(\"Failed to initialize trust store from \" + keyStorePath, e);\n        }\n    }\n\n    private void registerTrustStore(String trustStorePath, QuarkusRestClientBuilder builder) {\n        Optional<String> maybeTrustStorePassword = oneOf(restClientConfig.trustStorePassword(),\n                configRoot.trustStorePassword());\n        Optional<String> maybeTrustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());\n\n        try {\n            KeyStore trustStore = KeyStore.getInstance(maybeTrustStoreType.orElse(\"JKS\"));\n            if (maybeTrustStorePassword.isEmpty()) {\n                throw new IllegalArgumentException(\"No password provided for truststore\");","sourceCodeStart":302,"sourceCodeEnd":338,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java#L302-L338","documentation":"Quarkus's RestClientCDIDelegateBuilder throws this IllegalArgumentException when it cannot load the client's keystore file into a java.security.KeyStore while building the REST client from MicroProfile/Quarkus TLS config. Despite the message text saying 'trust store', this instance is the key store (registerKeyStore). The KeyStore.load() call failed with IOException, CertificateException, or NoSuchAlgorithmException — typically because the file is missing/corrupt, the password is wrong, or the declared type (default JKS) does not match the actual format.","triggerScenarios":"quarkus.rest-client.<key>.key-store-type (or quarkus.restclient.key-store-type) set to a type that doesn't match the file, or a wrong key-store-password, or a file that is corrupt/empty/not a keystore, passed to registerKeyStore during client creation via configureTLSFromProperties. Note a truly missing path is caught earlier by locateStream, so this error means the stream opened but load() failed.","commonSituations":"Password typo or password rotated in the vault but not in application.properties; file regenerated as PKCS12 while config still says JKS; truncated or text-format certificate exported instead of a keystore; wrong keystore used for a different alias/environment (dev vs prod).","solutions":["Verify the password in quarkus.rest-client.<key>.key-store-password matches the actual keystore password","Check quarkus.rest-client.<key>.key-store-type matches the file format (e.g. PKCS12 for .p12 files instead of the JKS default)","Validate the file with: keytool -list -keystore <path> -storetype <type> — if keytool fails, the file or password is wrong","Re-export/regenerate the keystore with keytool if it is corrupt or in the wrong format"],"exampleFix":"// before\nquarkus.rest-client.my-client.key-store-type=JKS\nquarkus.rest-client.my-client.key-store-password=changeme\n// after (file is actually PKCS12)\nquarkus.rest-client.my-client.key-store-type=PKCS12\nquarkus.rest-client.my-client.key-store-password=correct-password","handlingStrategy":"validation","validationCode":"import java.io.FileInputStream;\nimport java.security.KeyStore;\n\n// run at startup, before the client is created\nString path = config.getValue(\"quarkus.rest-client.my-client.key-store\");\nString pass = config.getValue(\"quarkus.rest-client.my-client.key-store-password\");\nString type = config.getOptionalValue(\"quarkus.rest-client.my-client.key-store-type\", String.class).orElse(\"JKS\");\ntry (var in = path.startsWith(\"classpath:\")\n        ? Thread.currentThread().getContextClassLoader().getResourceAsStream(path.replaceFirst(\"classpath:\", \"\"))\n        : new FileInputStream(path.replaceFirst(\"file:\", \"\"))) {\n    KeyStore.getInstance(type).load(in, pass.toCharArray()); // throws same way if bad\n    System.out.println(\"Key store OK: \" + path);\n} catch (Exception e) {\n    throw new IllegalStateException(\"Invalid key store config: \" + e.getMessage(), e);\n}","typeGuard":"static boolean isValidKeyStoreConfig(String path, String password, String type) {\n    if (path == null || password == null || type == null) return false;\n    try {\n        try (var in = new FileInputStream(path)) {\n            KeyStore.getInstance(type).load(in, password.toCharArray());\n        }\n        return true;\n    } catch (Exception e) {\n        return false;\n    }\n}","tryCatchPattern":"try {\n    MyClient client = QuarkusRestClientBuilder.newBuilder()\n            .baseUri(uri)\n            .keyStore(keyStorePath, password)\n            .build(MyClient.class);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage() != null && e.getMessage().startsWith(\"Failed to initialize trust store\")) {\n        throw new ConfigurationException(\"Check key-store-password and key-store-type: \" + e.getMessage(), e);\n    }\n    throw e;\n}","preventionTips":["Verify every keystore with 'keytool -list' using the exact configured type and password before deploying","Keep passwords in env vars/config secrets, not hardcoded, and rotate both file and config together","Never point key-store at a raw PEM certificate; always import into a real keystore","Add a startup health check that loads all configured keystores once"],"tags":["tls","keystore","rest-client","configuration"],"backgroundTag":"keystore-load-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}