{"record":{"id":"c82fda122c708b08","repo":"quarkusio/quarkus","slug":"failed-to-initialize-trust-store-from-keystore","errorCode":null,"errorMessage":"Failed to initialize trust store from \" + keyStorePath","messagePattern":"Failed to initialize trust store from \" \\+ keyStorePath","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java","lineNumber":326,"sourceCode":"        Optional<String> keyStoreType = oneOf(restClientConfig.keyStoreType(), configRoot.keyStoreType());\n\n        try {\n            KeyStore keyStore = KeyStore.getInstance(keyStoreType.orElse(\"JKS\"));\n            if (keyStorePassword.isEmpty()) {\n                throw new IllegalArgumentException(\"No password provided for keystore\");\n            }\n            String password = keyStorePassword.get();\n\n            try (InputStream input = locateStream(keyStorePath)) {\n                keyStore.load(input, password.toCharArray());\n            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {\n                throw new IllegalArgumentException(\"Failed to initialize trust store from classpath resource \" + keyStorePath,\n                        e);\n            }\n\n            builder.keyStore(keyStore, password);\n        } catch (KeyStoreException e) {\n            throw new IllegalArgumentException(\"Failed to initialize trust store from \" + keyStorePath, e);\n        }\n    }\n\n    private void registerTrustStore(String trustStorePath, QuarkusRestClientBuilder builder) {\n        Optional<String> maybeTrustStorePassword = oneOf(restClientConfig.trustStorePassword(),\n                configRoot.trustStorePassword());\n        Optional<String> maybeTrustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());\n\n        try {\n            KeyStore trustStore = KeyStore.getInstance(maybeTrustStoreType.orElse(\"JKS\"));\n            if (maybeTrustStorePassword.isEmpty()) {\n                throw new IllegalArgumentException(\"No password provided for truststore\");\n            }\n            String password = maybeTrustStorePassword.get();\n\n            try (InputStream input = locateStream(trustStorePath)) {\n                trustStore.load(input, password.toCharArray());\n            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {","sourceCodeStart":308,"sourceCodeEnd":344,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java#L308-L344","documentation":"Thrown when KeyStore.getInstance() fails inside registerKeyStore — i.e. the configured key-store-type string is not a keystore type supported by any installed security provider. The builder wraps the KeyStoreException in this IllegalArgumentException naming the keystore path. Like the sibling error, the message misleadingly says 'trust store' although this path handles the client key store.","triggerScenarios":"Setting quarkus.rest-client.<key>.key-store-type (or the global quarkus.restclient.* equivalent) to an unknown/misspelled type (e.g. 'jks ' with trailing space, 'PKS12', or a type requiring a provider not on the classpath such as BCFKS without BouncyCastle registered).","commonSituations":"Typo in the type name; using a PKCS12 file with type left as misspelled value; native-image build where the provider for an exotic type isn't registered; copy-pasting type names from other platforms (e.g. 'Windows-MY' on Linux).","solutions":["Correct the key-store-type value to a standard JDK type: JKS, PKCS12, or JCEKS","Remove the key-store-type property entirely to accept the JKS default only if the file is truly JKS","If using a non-JDK type like BCFKS, add the BouncyCastle dependency and register the provider in native mode","Confirm with keytool -list -storetype <type> that the JVM supports the configured type"],"exampleFix":"// before\nquarkus.rest-client.my-client.key-store-type=PKS12\n// after\nquarkus.rest-client.my-client.key-store-type=PKCS12","handlingStrategy":"validation","validationCode":"String type = config.getOptionalValue(\"quarkus.rest-client.my-client.key-store-type\", String.class).orElse(\"JKS\");\ntry {\n    KeyStore.getInstance(type);\n} catch (KeyStoreException e) {\n    throw new ConfigurationException(\"Unsupported key-store-type '\" + type + \"'. Use JKS, PKCS12 or JCEKS.\", e);\n}","typeGuard":"static boolean isSupportedKeyStoreType(String type) {\n    try {\n        KeyStore.getInstance(type);\n        return true;\n    } catch (KeyStoreException e) {\n        return false;\n    }\n}","tryCatchPattern":"try {\n    return QuarkusRestClientBuilder.newBuilder().keyStore(path, password).build(MyClient.class);\n} catch (IllegalArgumentException e) {\n    if (e.getCause() instanceof KeyStoreException) {\n        throw new ConfigurationException(\"key-store-type not supported by any provider: \" + e.getMessage(), e);\n    }\n    throw e;\n}","preventionTips":["Only use standard JDK types (JKS, PKCS12, JCEKS) unless a provider dependency is explicitly added","Avoid copy-pasted type strings; prefer constants and trim whitespace from config values","In native images, register extra security providers and their keystore types","Fail fast in a startup bean that validates the type before any client call"],"tags":["tls","keystore","configuration","rest-client"],"backgroundTag":"keystore-load-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}