{"record":{"id":"ba9f6d87ab35613b","repo":"quarkusio/quarkus","slug":"failed-to-initialize-trust-store-from-truststore","errorCode":null,"errorMessage":"Failed to initialize trust store from ${trustStorePath}","messagePattern":"Failed to initialize trust store from (.+?)","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java","lineNumber":215,"sourceCode":"            Optional<String> trustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());\n            KeyStore trustStore = KeyStore.getInstance(trustStoreType.orElse(\"JKS\"));\n\n            Optional<String> trustStorePassword = oneOf(restClientConfig.trustStorePassword(), configRoot.trustStorePassword());\n            if (trustStorePassword.isEmpty()) {\n                throw new IllegalArgumentException(\"No password provided for truststore\");\n            }\n            String password = trustStorePassword.get();\n\n            try (InputStream input = locateStream(trustStorePath)) {\n                trustStore.load(input, password.toCharArray());\n            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {\n                throw new IllegalArgumentException(\"Failed to initialize trust store from classpath resource \" + trustStorePath,\n                        e);\n            }\n\n            builder.trustStore(trustStore);\n        } catch (KeyStoreException e) {\n            throw new IllegalArgumentException(\"Failed to initialize trust store from \" + trustStorePath, e);\n        }\n    }\n\n    private InputStream locateStream(String path) throws FileNotFoundException {\n        if (path.startsWith(\"classpath:\")) {\n            path = path.replaceFirst(\"classpath:\", \"\");\n            InputStream resultStream = Thread.currentThread().getContextClassLoader().getResourceAsStream(path);\n            if (resultStream == null) {\n                resultStream = getClass().getResourceAsStream(path);\n            }\n            if (resultStream == null) {\n                throw new IllegalArgumentException(\n                        \"Classpath resource \" + path + \" not found for MicroProfile Rest Client SSL configuration\");\n            }\n            return resultStream;\n        } else {\n            if (path.startsWith(\"file:\")) {\n                path = path.replaceFirst(\"file:\", \"\");","sourceCodeStart":197,"sourceCodeEnd":233,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java#L197-L233","documentation":"Thrown by registerTrustStore() when KeyStore.getInstance() itself fails with KeyStoreException, meaning the JVM has no provider for the requested trust-store type. Unlike the load failure, this happens before any file is read — the store type string is the problem.","triggerScenarios":"quarkus.rest-client.<key>.trust-store-type (or the global configRoot value) names a keystore type unsupported by the installed JCE providers, e.g. a typo like 'JKS ' or an exotic type such as 'WINDOWS-MY' on a headless Linux runtime.","commonSituations":"Typo in trust-store-type; type valid on a developer's desktop JDK but absent in the container's slimmer JVM; native-image build where the keystore provider was not registered.","solutions":["Fix the trust-store-type value — use JKS or PKCS12 which every JVM supports","List available types via Security.getAlgorithms(\"KeyStore\") in jshell and match exactly","If running native, ensure the keystore provider is registered (quarkus.ssl.native=true and default providers present)"],"exampleFix":"// before (application.properties)\nquarkus.rest-client.billing.trust-store-type=pkcs 12\n// after\nquarkus.rest-client.billing.trust-store-type=PKCS12","handlingStrategy":"validation","validationCode":"// ensure the type is supported by the runtime JVM\nString type = ConfigProvider.getConfig()\n    .getOptionalValue(\"quarkus.rest-client.my-client.trust-store-type\", String.class).orElse(\"JKS\");\nif (!java.security.Security.getAlgorithms(\"KeyStore\").contains(type)) {\n    throw new IllegalStateException(\"Unsupported keystore type: \" + type);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Stick to JKS or PKCS12 unless a specific provider is required","Smoke-test SSL config on the actual runtime image/JDK, not just the dev machine","Validate config values with a schema or startup assertion","Avoid hand-typed type strings — centralize them in constants"],"tags":["ssl","keystore","jvm","configuration"],"backgroundTag":"unsupported-keystore-type","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}