{"record":{"id":"d2653e0ae722a188","repo":"quarkusio/quarkus","slug":"no-password-provided-for-keystore-d2653e","errorCode":null,"errorMessage":"No password provided for keystore","messagePattern":"No password provided for keystore","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java","lineNumber":313,"sourceCode":"        } catch (InstantiationException | IllegalAccessException | InvocationTargetException e) {\n            throw new RuntimeException(\n                    \"Failed to instantiate hostname verifier class \" + verifier\n                            + \". Make sure it has a public, no-argument constructor\",\n                    e);\n        } catch (ClassCastException e) {\n            throw new RuntimeException(\"The provided hostname verifier \" + verifier + \" is not an instance of HostnameVerifier\",\n                    e);\n        }\n    }\n\n    private void registerKeyStore(String keyStorePath, QuarkusRestClientBuilder builder) {\n        Optional<String> keyStorePassword = oneOf(restClientConfig.keyStorePassword(), configRoot.keyStorePassword());\n        Optional<String> keyStoreType = oneOf(restClientConfig.keyStoreType(), configRoot.keyStoreType());\n\n        try {\n            KeyStore keyStore = KeyStore.getInstance(keyStoreType.orElse(\"JKS\"));\n            if (keyStorePassword.isEmpty()) {\n                throw new IllegalArgumentException(\"No password provided for keystore\");\n            }\n            String password = keyStorePassword.get();\n\n            try (InputStream input = locateStream(keyStorePath)) {\n                keyStore.load(input, password.toCharArray());\n            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {\n                throw new IllegalArgumentException(\"Failed to initialize trust store from classpath resource \" + keyStorePath,\n                        e);\n            }\n\n            builder.keyStore(keyStore, password);\n        } catch (KeyStoreException e) {\n            throw new IllegalArgumentException(\"Failed to initialize trust store from \" + keyStorePath, e);\n        }\n    }\n\n    private void registerTrustStore(String trustStorePath, QuarkusRestClientBuilder builder) {\n        Optional<String> maybeTrustStorePassword = oneOf(restClientConfig.trustStorePassword(),","sourceCodeStart":295,"sourceCodeEnd":331,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java#L295-L331","documentation":"registerKeyStore loads a keystore from the configured path and needs a password to load it. When neither the per-client config (quarkus.rest-client.<key>.keystore-password) nor the TLS config root provides a password, it throws this IllegalArgumentException before attempting to read the file. Quarkus does not default the keystore password.","triggerScenarios":"Setting a keystore path (key-store property) but omitting the corresponding keystore-password property for the same config key.","commonSituations":"Password kept only in an environment variable or vault not wired into config; typo between key-store and key-store-password property names; expecting a default password like 'changeit' which Quarkus does not assume.","solutions":["Set quarkus.rest-client.<config-key>.keystore-password=<password> (or the equivalent TLS root property).","Supply the password via environment variable expansion, e.g. quarkus.rest-client.my-client.keystore-password=${KEYSTORE_PASSWORD}.","Confirm the password property name matches the same config key used for the keystore path."],"exampleFix":"// before (application.properties)\nquarkus.rest-client.my-client.key-store=/certs/client.jks\n// missing password -> IllegalArgumentException\n\n// after\nquarkus.rest-client.my-client.key-store=/certs/client.jks\nquarkus.rest-client.my-client.keystore-password=${KEYSTORE_PASSWORD}","handlingStrategy":"validation","validationCode":"boolean passwordSet = config.getOptionalValue(\"quarkus.rest-client.my-client.keystore-password\", String.class).isPresent();\nif (!passwordSet) throw new IllegalStateException(\"key-store configured but keystore-password missing\");","typeGuard":"null","tryCatchPattern":"try {\n    // build client with keystore config\n} catch (IllegalArgumentException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"No password provided for keystore\")) {\n        // surface a clear config error to operators / abort startup with guidance\n    } else throw e;\n}","preventionTips":["Always pair key-store with keystore-password in the same config key scope.","Inject passwords via environment variables or a secrets vault rather than hardcoding.","Validate TLS config presence at startup with a fail-fast check."],"tags":["tls","keystore","configuration","rest-client"],"backgroundTag":"missing-keystore-password","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}