{"record":{"id":"fb10e3c074699e56","repo":"quarkusio/quarkus","slug":"failed-to-initialize-trust-store-from-truststo","errorCode":null,"errorMessage":"Failed to initialize trust store from \" + trustStorePath","messagePattern":"Failed to initialize trust store from \" \\+ trustStorePath","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java","lineNumber":351,"sourceCode":"        Optional<String> maybeTrustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());\n\n        try {\n            KeyStore trustStore = KeyStore.getInstance(maybeTrustStoreType.orElse(\"JKS\"));\n            if (maybeTrustStorePassword.isEmpty()) {\n                throw new IllegalArgumentException(\"No password provided for truststore\");\n            }\n            String password = maybeTrustStorePassword.get();\n\n            try (InputStream input = locateStream(trustStorePath)) {\n                trustStore.load(input, password.toCharArray());\n            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {\n                throw new IllegalArgumentException(\"Failed to initialize trust store from classpath resource \" + trustStorePath,\n                        e);\n            }\n\n            builder.trustStore(trustStore, password);\n        } catch (KeyStoreException e) {\n            throw new IllegalArgumentException(\"Failed to initialize trust store from \" + trustStorePath, e);\n        }\n    }\n\n    private InputStream locateStream(String path) throws FileNotFoundException {\n        if (path.startsWith(\"classpath:\")) {\n            path = path.replaceFirst(\"classpath:\", \"\");\n            InputStream resultStream = Thread.currentThread().getContextClassLoader().getResourceAsStream(path);\n            if (resultStream == null) {\n                resultStream = getClass().getResourceAsStream(path);\n            }\n            if (resultStream == null) {\n                throw new IllegalArgumentException(\n                        \"Classpath resource \" + path + \" not found for MicroProfile Rest Client SSL configuration\");\n            }\n            return resultStream;\n        } else {\n            if (path.startsWith(\"file:\")) {\n                path = path.replaceFirst(\"file:\", \"\");","sourceCodeStart":333,"sourceCodeEnd":369,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java#L333-L369","documentation":"Thrown when KeyStore.getInstance() fails for the trust store — the configured trust-store-type is not a type supported by any installed JCA security provider. The IllegalArgumentException names the trust store path. Same root cause family as error 1921 but for the trust store configuration.","triggerScenarios":"Setting quarkus.rest-client.<key>.trust-store-type (or global quarkus.restclient.trust-store-type) to an unsupported/misspelled value when the client is built, e.g. 'PCKS12', 'JKS ' with whitespace, or a provider-backed type whose provider is absent (especially in native images).","commonSituations":"Typo while copying type from another service; CI pipeline templating inserts an empty or wrong value; native-image build without BouncyCastle registration for BCFKS/PKCS12 variants from non-JDK providers; legacy configs referencing removed types.","solutions":["Fix trust-store-type to a standard type: JKS, PKCS12, or JCEKS","Remove the property to fall back to the JKS default (only if the file is JKS)","Add and register the required security provider (e.g. BouncyCastle) if a non-JDK type is needed, ensuring native-image support","Sanitize the config value: trim whitespace and compare against keytool -list -storetype <type> support"],"exampleFix":"// before\nquarkus.restclient.trust-store-type=PCKS12\n// after\nquarkus.restclient.trust-store-type=PKCS12","handlingStrategy":"validation","validationCode":"String type = config.getOptionalValue(\"quarkus.rest-client.my-client.trust-store-type\", String.class).orElse(\"JKS\");\ntry {\n    KeyStore.getInstance(type);\n} catch (KeyStoreException e) {\n    throw new ConfigurationException(\"Unsupported trust-store-type '\" + type + \"'. Use JKS, PKCS12 or JCEKS.\", e);\n}","typeGuard":"static boolean isSupportedTrustStoreType(String type) {\n    try {\n        KeyStore.getInstance(type);\n        return true;\n    } catch (KeyStoreException e) {\n        return false;\n    }\n}","tryCatchPattern":"try {\n    return QuarkusRestClientBuilder.newBuilder().trustStore(path, password).build(MyClient.class);\n} catch (IllegalArgumentException e) {\n    if (e.getCause() instanceof KeyStoreException) {\n        throw new ConfigurationException(\"trust-store-type not supported by any JCA provider: \" + e.getMessage(), e);\n    }\n    throw e;\n}","preventionTips":["Standardize on PKCS12 (or JKS) across services; avoid exotic provider types","Trim and lower-case type values coming from templated config to avoid typos/whitespace","If BouncyCastle types are required, add the dependency and register the provider for native builds","Validate the type once at application startup before any REST client is created"],"tags":["tls","truststore","configuration","rest-client"],"backgroundTag":"keystore-load-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}