quarkusio/quarkus · error · IllegalArgumentException

Certificate file: " + path + " not found for MicroProfile…

Error message

Certificate file: " + path + " not found for MicroProfile Rest Client SSL configuration

What it means

Thrown by RestClientCDIDelegateBuilder.locateStream when an SSL keystore/truststore path without the 'classpath:' scheme is treated as a filesystem path (an optional 'file:' prefix is stripped) and new File(path).isFile() returns false. Quarkus cannot open the certificate file, so it fails fast while configuring the rest client's SSL.

Solutions

Verify the absolute path exists and is a regular file: ls -l /path/to/store.p12; fix the configured path to the real location
Prefer absolute paths (file:/etc/certs/keystore.p12) over relative ones so behavior does not depend on the process working directory
In containers, confirm the secret/configmap volumeMount path matches the configured path and the pod actually mounts it
If the certificate should ship with the app, prefix the path with 'classpath:' and place it in src/main/resources instead
Check permissions: the user running the app must be able to read the file

Example fix

// before
quarkus.rest-client.myservice.trust-store=file:certs/truststore.p12
// after (absolute path)
quarkus.rest-client.myservice.trust-store=file:/etc/certs/truststore.p12

Defensive patterns

Strategy: validation

Validate before calling

String path = configValue.replaceFirst("^file:", "");
if (!java.nio.file.Files.isRegularFile(java.nio.file.Path.of(path))) {
    throw new IllegalStateException("Keystore file not found on disk: " + path);
}

Try / catch

try {
    MyClient client = Arc.container().instance(MyClient.class).get();
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("Certificate file")) {
        throw new ConfigurationException("Check key-store/trust-store file path and volume mounts", e);
    }
    throw e;
}

Prevention

Use absolute file paths in configuration so resolution is independent of working directory
In Kubernetes, verify secret volumeMounts match configured paths before rollout
Add a readiness/startup check that reads the certificate file
Mount certs at stable conventional locations like /etc/certs/

When it happens

Trigger: quarkus.rest-client.<key>.key-store / trust-store (or MP equivalents) is set to a file path like /etc/certs/store.p12 or file:certs/store.p12, but no regular file exists at that path on the machine running the application; registerKeyStore/registerTrustStore -> locateStream hits the filesystem branch.

Common situations: Kubernetes/container deployments where the secret volume is not mounted or mounted at a different path than configured; relative path that resolves against the process working directory rather than the app root (dev mode vs packaged jar differ); typo or wrong filename; file exists but is a directory/symlink to nothing; config copied from a teammate's machine with different paths.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/c7ef2c40ba21448f. Report an issue: GitHub.

Appendix: source

Thrown at extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java:373

    private InputStream locateStream(String path) throws FileNotFoundException {
        if (path.startsWith("classpath:")) {
            path = path.replaceFirst("classpath:", "");
            InputStream resultStream = Thread.currentThread().getContextClassLoader().getResourceAsStream(path);
            if (resultStream == null) {
                resultStream = getClass().getResourceAsStream(path);
            }
            if (resultStream == null) {
                throw new IllegalArgumentException(
                        "Classpath resource " + path + " not found for MicroProfile Rest Client SSL configuration");
            }
            return resultStream;
        } else {
            if (path.startsWith("file:")) {
                path = path.replaceFirst("file:", "");
            }
            File certificateFile = new File(path);
            if (!certificateFile.isFile()) {
                throw new IllegalArgumentException(
                        "Certificate file: " + path + " not found for MicroProfile Rest Client SSL configuration");
            }
            return new FileInputStream(certificateFile);
        }
    }

    private void configureProviders(QuarkusRestClientBuilder builder) {
        Optional<String> maybeProviders = oneOf(restClientConfig.providers(), configRoot.providers());
        if (maybeProviders.isPresent()) {
            registerProviders(builder, maybeProviders.get());
        }
    }

    private void registerProviders(QuarkusRestClientBuilder builder, String providersAsString) {
        for (String s : providersAsString.split(",")) {
            builder.register(providerClassForName(s.trim()));
        }
    }

View on GitHub (pinned to e1c734241f)