{"record":{"id":"c1efdc6a0bd8051e","repo":"quarkusio/quarkus","slug":"failed-to-initialize-trust-store-from-classpath-re-c1efdc","errorCode":null,"errorMessage":"Failed to initialize trust store from classpath resource \" + trustStorePath","messagePattern":"Failed to initialize trust store from classpath resource \" \\+ trustStorePath","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java","lineNumber":345,"sourceCode":"        }\n    }\n\n    private void registerTrustStore(String trustStorePath, QuarkusRestClientBuilder builder) {\n        Optional<String> maybeTrustStorePassword = oneOf(restClientConfig.trustStorePassword(),\n                configRoot.trustStorePassword());\n        Optional<String> maybeTrustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());\n\n        try {\n            KeyStore trustStore = KeyStore.getInstance(maybeTrustStoreType.orElse(\"JKS\"));\n            if (maybeTrustStorePassword.isEmpty()) {\n                throw new IllegalArgumentException(\"No password provided for truststore\");\n            }\n            String password = maybeTrustStorePassword.get();\n\n            try (InputStream input = locateStream(trustStorePath)) {\n                trustStore.load(input, password.toCharArray());\n            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {\n                throw new IllegalArgumentException(\"Failed to initialize trust store from classpath resource \" + trustStorePath,\n                        e);\n            }\n\n            builder.trustStore(trustStore, password);\n        } catch (KeyStoreException e) {\n            throw new IllegalArgumentException(\"Failed to initialize trust store from \" + trustStorePath, e);\n        }\n    }\n\n    private InputStream locateStream(String path) throws FileNotFoundException {\n        if (path.startsWith(\"classpath:\")) {\n            path = path.replaceFirst(\"classpath:\", \"\");\n            InputStream resultStream = Thread.currentThread().getContextClassLoader().getResourceAsStream(path);\n            if (resultStream == null) {\n                resultStream = getClass().getResourceAsStream(path);\n            }\n            if (resultStream == null) {\n                throw new IllegalArgumentException(","sourceCodeStart":327,"sourceCodeEnd":363,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java#L327-L363","documentation":"Thrown by registerTrustStore when KeyStore.load() on the configured trust store fails with IOException, CertificateException, or NoSuchAlgorithmException. The stream was located successfully, but the content could not be parsed as a keystore of the declared type or the integrity password is wrong. This is the trust-store counterpart of error 1920.","triggerScenarios":"quarkus.rest-client.<key>.trust-store points to a PEM certificate instead of a JKS/PKCS12 trust store, the trust-store-type doesn't match the actual format, or trust-store-password is wrong, when the REST client is created.","commonSituations":"Downloading a server certificate (PEM) and pointing trust-store at it directly instead of importing it into a keystore with keytool; dev/prod truststore passwords differ; a .jks file got re-saved as PKCS12 (or vice versa) by a pipeline; empty or HTML error page saved as the truststore file.","solutions":["Import the PEM certificate into a proper trust store: keytool -importcert -alias srv -file cert.pem -keystore truststore.p12 -storetype PKCS12","Verify the password with keytool -list -keystore <path> and fix quarkus.rest-client.<key>.trust-store-password","Align trust-store-type with the real file format (PKCS12 vs JKS)","Re-download/recreate the truststore file if it is corrupt, empty, or not a keystore"],"exampleFix":"// before\nquarkus.rest-client.my-client.trust-store=file:certs/server-cert.pem\n// after\n# first: keytool -importcert -alias server -file certs/server-cert.pem -keystore certs/truststore.p12 -storetype PKCS12\nquarkus.rest-client.my-client.trust-store=file:certs/truststore.p12\nquarkus.rest-client.my-client.trust-store-type=PKCS12\nquarkus.rest-client.my-client.trust-store-password=changeit","handlingStrategy":"validation","validationCode":"String tsPath = config.getValue(\"quarkus.rest-client.my-client.trust-store\");\nString tsPass = config.getValue(\"quarkus.rest-client.my-client.trust-store-password\");\nString tsType = config.getOptionalValue(\"quarkus.rest-client.my-client.trust-store-type\", String.class).orElse(\"JKS\");\ntry (var in = new FileInputStream(tsPath.replaceFirst(\"file:\", \"\"))) {\n    KeyStore.getInstance(tsType).load(in, tsPass.toCharArray());\n    System.out.println(\"Trust store OK: \" + tsPath);\n} catch (Exception e) {\n    throw new IllegalStateException(\"Invalid trust store (wrong password, PEM file, or type mismatch): \" + e.getMessage(), e);\n}","typeGuard":"static boolean isLoadableTrustStore(String path, String password, String type) {\n    try (var in = new FileInputStream(path)) {\n        KeyStore.getInstance(type).load(in, password.toCharArray());\n        return true;\n    } catch (Exception e) {\n        return false;\n    }\n}","tryCatchPattern":"try {\n    MyClient client = QuarkusRestClientBuilder.newBuilder()\n            .baseUri(uri)\n            .trustStore(trustStorePath, trustStorePassword)\n            .build(MyClient.class);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage() != null && e.getMessage().contains(trustStorePath)) {\n        throw new ConfigurationException(\n            \"Trust store could not be loaded. Ensure it is a real JKS/PKCS12 store (not PEM) and the password/type match: \"\n            + e.getMessage(), e);\n    }\n    throw e;\n}","preventionTips":["Never point trust-store at a raw .pem/.crt file; import it into a keystore with keytool first","Validate trust stores in CI using keytool with the same type and password used in config","Match trust-store-type to the actual file extension/format (.p12/.pfx = PKCS12, .jks = JKS)","Hash/compare dev and prod truststore files so environment drift is caught early"],"tags":["tls","truststore","rest-client","configuration"],"backgroundTag":"keystore-load-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}