{"record":{"id":"cfcbe9eda63fed9e","repo":"quarkusio/quarkus","slug":"failed-to-initialize-trust-store-from-classpath-re","errorCode":null,"errorMessage":"Failed to initialize trust store from classpath resource ${keyStorePath}","messagePattern":"Failed to initialize trust store from classpath resource (.+?)","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java","lineNumber":185,"sourceCode":"                    e);\n        }\n    }\n\n    private void registerKeyStore(String keyStorePath, RestClientBuilder builder) {\n        try {\n            Optional<String> keyStoreType = oneOf(restClientConfig.keyStoreType(), configRoot.keyStoreType());\n            KeyStore keyStore = KeyStore.getInstance(keyStoreType.orElse(\"JKS\"));\n\n            Optional<String> keyStorePassword = oneOf(restClientConfig.keyStorePassword(), configRoot.keyStorePassword());\n            if (keyStorePassword.isEmpty()) {\n                throw new IllegalArgumentException(\"No password provided for keystore\");\n            }\n            String password = keyStorePassword.get();\n\n            try (InputStream input = locateStream(keyStorePath)) {\n                keyStore.load(input, password.toCharArray());\n            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {\n                throw new IllegalArgumentException(\"Failed to initialize trust store from classpath resource \" + keyStorePath,\n                        e);\n            }\n\n            builder.keyStore(keyStore, password);\n        } catch (KeyStoreException e) {\n            throw new IllegalArgumentException(\"Failed to initialize trust store from \" + keyStorePath, e);\n        }\n    }\n\n    private void registerTrustStore(String trustStorePath, RestClientBuilder builder) {\n        try {\n            Optional<String> trustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());\n            KeyStore trustStore = KeyStore.getInstance(trustStoreType.orElse(\"JKS\"));\n\n            Optional<String> trustStorePassword = oneOf(restClientConfig.trustStorePassword(), configRoot.trustStorePassword());\n            if (trustStorePassword.isEmpty()) {\n                throw new IllegalArgumentException(\"No password provided for truststore\");\n            }","sourceCodeStart":167,"sourceCodeEnd":203,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java#L167-L203","documentation":"The keystore was created and a password was present, but loading the keystore from the located stream failed with an IOException, CertificateException, or NoSuchAlgorithmException. The path in the message is the configured keystore resource; the cause contains the underlying reason (bad password, corrupt file, unsupported algorithm).","triggerScenarios":"registerKeyStore called with a path resolvable by locateStream, but keyStore.load(input, password) throws — wrong password ('Given final block not properly padded' for PKCS12/JKS), corrupted keystore file, certificate format issues, or wrong keystore type for the file format.","commonSituations":"Typo in the keystore password; keystore saved in a different format than the configured type (default JKS vs actual PKCS12); truncated or binary-mangled resource after resource filtering by Maven/Gradle; JVM not supporting the specified keystore type/algorithm.","solutions":["Verify the keystore password is correct","Set quarkus.rest-client.<name>.keystore-type to the actual format (e.g. PKCS12) instead of the default JKS","Check the file isn't corrupted or filtered during build (exclude binary resources from resource filtering)","Regenerate the keystore with keytool if the file is damaged"],"exampleFix":"# before\nquarkus.rest-client.my-client.keystore-path=certs/client.p12\n# after\nquarkus.rest-client.my-client.keystore-path=certs/client.p12\nquarkus.rest-client.my-client.keystore-type=PKCS12","handlingStrategy":"try-catch","validationCode":"try (InputStream in = getClass().getResourceAsStream(keystorePath)) {\n    KeyStore ks = KeyStore.getInstance(keystoreType != null ? keystoreType : \"JKS\");\n    ks.load(in, password.toCharArray()); // same check the library performs\n}","typeGuard":null,"tryCatchPattern":"try {\n    // create rest client\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().startsWith(\"Failed to initialize trust store\")) {\n        log.error(\"Keystore load failed: \" + e.getCause(), e.getCause());\n    }\n}","preventionTips":["Verify the keystore password with keytool -list before deploying","Set keystore-type to match the file format (PKCS12 vs JKS)","Exclude binary resources from build-time filtering to avoid corruption","Test keystore loading in CI on the same JVM version used in production"],"tags":["restclient","ssl","keystore"],"backgroundTag":"keystore-load-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}