quarkusio/quarkus · error · IllegalArgumentException

Certificate file: ${path} not found for MicroProfile Rest Cl

Error message

Certificate file: ${path} not found for MicroProfile Rest Client SSL configuration

What it means

locateStream() handles non-classpath paths as filesystem paths (after stripping an optional file: prefix). When new File(path).isFile() is false it throws this IllegalArgumentException — the certificate/keystore file does not exist or is a directory at that location.

Source

Thrown at extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java:237

    private InputStream locateStream(String path) throws FileNotFoundException {
        if (path.startsWith("classpath:")) {
            path = path.replaceFirst("classpath:", "");
            InputStream resultStream = Thread.currentThread().getContextClassLoader().getResourceAsStream(path);
            if (resultStream == null) {
                resultStream = getClass().getResourceAsStream(path);
            }
            if (resultStream == null) {
                throw new IllegalArgumentException(
                        "Classpath resource " + path + " not found for MicroProfile Rest Client SSL configuration");
            }
            return resultStream;
        } else {
            if (path.startsWith("file:")) {
                path = path.replaceFirst("file:", "");
            }
            File certificateFile = new File(path);
            if (!certificateFile.isFile()) {
                throw new IllegalArgumentException(
                        "Certificate file: " + path + " not found for MicroProfile Rest Client SSL configuration");
            }
            return new FileInputStream(certificateFile);
        }
    }

    protected void configureProviders(RestClientBuilder builder) {
        Optional<String> providers = oneOf(restClientConfig.providers(), configRoot.providers());
        if (providers.isPresent()) {
            registerProviders(builder, providers.get());
        }
        if (clientProviders != null) {
            for (Class<?> annotationProvider : clientProviders) {
                builder.register(annotationProvider);
            }
        }
    }

View on GitHub (pinned to e1c734241f)

Solutions

1. Confirm the absolute path exists inside the runtime container: ls -l /etc/certs/truststore.jks via an exec into the pod/image
2. Fix the mount: ensure the volume/secret is mounted at the configured path in deployment manifests
3. Use absolute file: paths instead of relative ones to remove working-directory ambiguity
4. If the file is generated at startup, generate it before the REST client bean is created (init container or eager observer)

Example fix

// before (application.properties)
quarkus.rest-client.shipping.trust-store=truststore.jks
// after
quarkus.rest-client.shipping.trust-store=file:/etc/certs/truststore.jks
// and ensure: COPY truststore.jks /etc/certs/ in the Dockerfile

// check the file before configuring the client
Path p = Path.of("/etc/certs/truststore.jks");
if (!Files.isRegularFile(p) || !Files.isReadable(p)) {
    throw new IllegalStateException("Certificate file missing/unreadable: " + p);
}

When it happens

Trigger: quarkus.rest-client.<key>.trust-store or keystore is a plain path or file:/path value whose target is missing, deleted at startup, or a directory; container image built without the cert file being COPYed in.

Common situations: Kubernetes volume not mounted or mounted at a different path; secret name mismatch in the deployment YAML; relative path interpreted against a different working directory in the container; cert generated at runtime after the client is built.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Certificate file: " + path + " not found for MicroProfile Re
• Failure to copy certificate pem: + ex.getMessage()
• Failed to create output directory for generated sources: %s
• ${archiveRoot} does not point to the application output dire
• IOException (wrapped)

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/37399b05169f08c6. Report an issue: GitHub.