quarkusio/quarkus · error · IllegalArgumentException

Certificate file: " + path + " not found for MicroProfile Re

Error message

Certificate file: " + path + " not found for MicroProfile Rest Client SSL configuration

What it means

Thrown by RestClientCDIDelegateBuilder.locateStream when an SSL keystore/truststore path without the 'classpath:' scheme is treated as a filesystem path (an optional 'file:' prefix is stripped) and new File(path).isFile() returns false. Quarkus cannot open the certificate file, so it fails fast while configuring the rest client's SSL.

Source

Thrown at extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java:373

    private InputStream locateStream(String path) throws FileNotFoundException {
        if (path.startsWith("classpath:")) {
            path = path.replaceFirst("classpath:", "");
            InputStream resultStream = Thread.currentThread().getContextClassLoader().getResourceAsStream(path);
            if (resultStream == null) {
                resultStream = getClass().getResourceAsStream(path);
            }
            if (resultStream == null) {
                throw new IllegalArgumentException(
                        "Classpath resource " + path + " not found for MicroProfile Rest Client SSL configuration");
            }
            return resultStream;
        } else {
            if (path.startsWith("file:")) {
                path = path.replaceFirst("file:", "");
            }
            File certificateFile = new File(path);
            if (!certificateFile.isFile()) {
                throw new IllegalArgumentException(
                        "Certificate file: " + path + " not found for MicroProfile Rest Client SSL configuration");
            }
            return new FileInputStream(certificateFile);
        }
    }

    private void configureProviders(QuarkusRestClientBuilder builder) {
        Optional<String> maybeProviders = oneOf(restClientConfig.providers(), configRoot.providers());
        if (maybeProviders.isPresent()) {
            registerProviders(builder, maybeProviders.get());
        }
    }

    private void registerProviders(QuarkusRestClientBuilder builder, String providersAsString) {
        for (String s : providersAsString.split(",")) {
            builder.register(providerClassForName(s.trim()));
        }
    }

View on GitHub (pinned to e1c734241f)

Solutions

Verify the absolute path exists and is a regular file: ls -l /path/to/store.p12; fix the configured path to the real location
Prefer absolute paths (file:/etc/certs/keystore.p12) over relative ones so behavior does not depend on the process working directory
In containers, confirm the secret/configmap volumeMount path matches the configured path and the pod actually mounts it
If the certificate should ship with the app, prefix the path with 'classpath:' and place it in src/main/resources instead
Check permissions: the user running the app must be able to read the file

Example fix

// before
quarkus.rest-client.myservice.trust-store=file:certs/truststore.p12
// after (absolute path)
quarkus.rest-client.myservice.trust-store=file:/etc/certs/truststore.p12

Defensive patterns

Strategy: validation

Validate before calling

String path = configValue.replaceFirst("^file:", "");
if (!java.nio.file.Files.isRegularFile(java.nio.file.Path.of(path))) {
    throw new IllegalStateException("Keystore file not found on disk: " + path);
}

Try / catch

try {
    MyClient client = Arc.container().instance(MyClient.class).get();
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("Certificate file")) {
        throw new ConfigurationException("Check key-store/trust-store file path and volume mounts", e);
    }
    throw e;
}

Prevention

Use absolute file paths in configuration so resolution is independent of working directory
In Kubernetes, verify secret volumeMounts match configured paths before rollout
Add a readiness/startup check that reads the certificate file
Mount certs at stable conventional locations like /etc/certs/

When it happens

Trigger: quarkus.rest-client.<key>.key-store / trust-store (or MP equivalents) is set to a file path like /etc/certs/store.p12 or file:certs/store.p12, but no regular file exists at that path on the machine running the application; registerKeyStore/registerTrustStore -> locateStream hits the filesystem branch.

Common situations: Kubernetes/container deployments where the secret volume is not mounted or mounted at a different path than configured; relative path that resolves against the process working directory rather than the app root (dev mode vs packaged jar differ); typo or wrong filename; file exists but is a directory/symlink to nothing; config copied from a teammate's machine with different paths.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/c7ef2c40ba21448f. Report an issue: GitHub.