{"record":{"id":"c7ef2c40ba21448f","repo":"quarkusio/quarkus","slug":"certificate-file-path-not-found-for-micro","errorCode":null,"errorMessage":"Certificate file: \" + path + \" not found for MicroProfile Rest Client SSL configuration","messagePattern":"Certificate file: \" \\+ path \\+ \" not found for MicroProfile Rest Client SSL configuration","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java","lineNumber":373,"sourceCode":"    private InputStream locateStream(String path) throws FileNotFoundException {\n        if (path.startsWith(\"classpath:\")) {\n            path = path.replaceFirst(\"classpath:\", \"\");\n            InputStream resultStream = Thread.currentThread().getContextClassLoader().getResourceAsStream(path);\n            if (resultStream == null) {\n                resultStream = getClass().getResourceAsStream(path);\n            }\n            if (resultStream == null) {\n                throw new IllegalArgumentException(\n                        \"Classpath resource \" + path + \" not found for MicroProfile Rest Client SSL configuration\");\n            }\n            return resultStream;\n        } else {\n            if (path.startsWith(\"file:\")) {\n                path = path.replaceFirst(\"file:\", \"\");\n            }\n            File certificateFile = new File(path);\n            if (!certificateFile.isFile()) {\n                throw new IllegalArgumentException(\n                        \"Certificate file: \" + path + \" not found for MicroProfile Rest Client SSL configuration\");\n            }\n            return new FileInputStream(certificateFile);\n        }\n    }\n\n    private void configureProviders(QuarkusRestClientBuilder builder) {\n        Optional<String> maybeProviders = oneOf(restClientConfig.providers(), configRoot.providers());\n        if (maybeProviders.isPresent()) {\n            registerProviders(builder, maybeProviders.get());\n        }\n    }\n\n    private void registerProviders(QuarkusRestClientBuilder builder, String providersAsString) {\n        for (String s : providersAsString.split(\",\")) {\n            builder.register(providerClassForName(s.trim()));\n        }\n    }","sourceCodeStart":355,"sourceCodeEnd":391,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java#L355-L391","documentation":"Thrown by RestClientCDIDelegateBuilder.locateStream when an SSL keystore/truststore path without the 'classpath:' scheme is treated as a filesystem path (an optional 'file:' prefix is stripped) and new File(path).isFile() returns false. Quarkus cannot open the certificate file, so it fails fast while configuring the rest client's SSL.","triggerScenarios":"quarkus.rest-client.<key>.key-store / trust-store (or MP equivalents) is set to a file path like /etc/certs/store.p12 or file:certs/store.p12, but no regular file exists at that path on the machine running the application; registerKeyStore/registerTrustStore -> locateStream hits the filesystem branch.","commonSituations":"Kubernetes/container deployments where the secret volume is not mounted or mounted at a different path than configured; relative path that resolves against the process working directory rather than the app root (dev mode vs packaged jar differ); typo or wrong filename; file exists but is a directory/symlink to nothing; config copied from a teammate's machine with different paths.","solutions":["Verify the absolute path exists and is a regular file: ls -l /path/to/store.p12; fix the configured path to the real location","Prefer absolute paths (file:/etc/certs/keystore.p12) over relative ones so behavior does not depend on the process working directory","In containers, confirm the secret/configmap volumeMount path matches the configured path and the pod actually mounts it","If the certificate should ship with the app, prefix the path with 'classpath:' and place it in src/main/resources instead","Check permissions: the user running the app must be able to read the file"],"exampleFix":"// before\nquarkus.rest-client.myservice.trust-store=file:certs/truststore.p12\n// after (absolute path)\nquarkus.rest-client.myservice.trust-store=file:/etc/certs/truststore.p12","handlingStrategy":"validation","validationCode":"String path = configValue.replaceFirst(\"^file:\", \"\");\nif (!java.nio.file.Files.isRegularFile(java.nio.file.Path.of(path))) {\n    throw new IllegalStateException(\"Keystore file not found on disk: \" + path);\n}","typeGuard":null,"tryCatchPattern":"try {\n    MyClient client = Arc.container().instance(MyClient.class).get();\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"Certificate file\")) {\n        throw new ConfigurationException(\"Check key-store/trust-store file path and volume mounts\", e);\n    }\n    throw e;\n}","preventionTips":["Use absolute file paths in configuration so resolution is independent of working directory","In Kubernetes, verify secret volumeMounts match configured paths before rollout","Add a readiness/startup check that reads the certificate file","Mount certs at stable conventional locations like /etc/certs/"],"tags":["ssl","rest-client","filesystem","configuration","microprofile"],"backgroundTag":"certificate-file-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}