quarkusio/quarkus · error · IllegalArgumentException

Classpath resource " + path + " not found for MicroProfile R

Error message

Classpath resource " + path + " not found for MicroProfile Rest Client SSL configuration

What it means

Thrown by RestClientCDIDelegateBuilder.locateStream when an SSL keystore/truststore path configured with the 'classpath:' scheme cannot be resolved as a resource on the classpath. Both the thread-context classloader and the builder class loader were tried and returned null, so Quarkus fails fast rather than silently starting the client without SSL material.

Source

Thrown at extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java:363

                throw new IllegalArgumentException("Failed to initialize trust store from classpath resource " + trustStorePath,
                        e);
            }

            builder.trustStore(trustStore, password);
        } catch (KeyStoreException e) {
            throw new IllegalArgumentException("Failed to initialize trust store from " + trustStorePath, e);
        }
    }

    private InputStream locateStream(String path) throws FileNotFoundException {
        if (path.startsWith("classpath:")) {
            path = path.replaceFirst("classpath:", "");
            InputStream resultStream = Thread.currentThread().getContextClassLoader().getResourceAsStream(path);
            if (resultStream == null) {
                resultStream = getClass().getResourceAsStream(path);
            }
            if (resultStream == null) {
                throw new IllegalArgumentException(
                        "Classpath resource " + path + " not found for MicroProfile Rest Client SSL configuration");
            }
            return resultStream;
        } else {
            if (path.startsWith("file:")) {
                path = path.replaceFirst("file:", "");
            }
            File certificateFile = new File(path);
            if (!certificateFile.isFile()) {
                throw new IllegalArgumentException(
                        "Certificate file: " + path + " not found for MicroProfile Rest Client SSL configuration");
            }
            return new FileInputStream(certificateFile);
        }
    }

    private void configureProviders(QuarkusRestClientBuilder builder) {
        Optional<String> maybeProviders = oneOf(restClientConfig.providers(), configRoot.providers());

View on GitHub (pinned to e1c734241f)

Solutions

Put the keystore/truststore file under src/main/resources at exactly the path given after 'classpath:' (e.g. classpath:ssl/keystore.p12 -> src/main/resources/ssl/keystore.p12) and rebuild
Check the packaged jar/runner: unzip target/quarkus-app/quarkus-run.jar (or the artifact jar) and verify the resource exists; adjust path or Maven resource includes accordingly
Use an absolute filesystem path with 'file:' scheme instead of classpath: if the certificate is provisioned externally (e.g. mounted secret)
Verify the classloader visibility: in tests, ensure the resource is on the test classpath of the module running the test
If in native mode, confirm the resource is bundled (Quarkus includes classpath resources by default; check quarkus.native.resources.includes if needed)

Example fix

// before (application.properties)
quarkus.rest-client.myservice.key-store=classpath:keys/keystore.p12
// after (file actually moved to resources root)
quarkus.rest-client.myservice.key-store=classpath:keystore.p12
// or use a file path:
quarkus.rest-client.myservice.key-store=file:/etc/certs/keystore.p12

Defensive patterns

Strategy: validation

Validate before calling

String path = configValue.replaceFirst("classpath:", "");
if (Thread.currentThread().getContextClassLoader().getResource(path) == null) {
    throw new IllegalStateException("Keystore resource missing from classpath: " + path);
}

Try / catch

try {
    MyClient client = Arc.container().instance(MyClient.class).get();
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("Classpath resource")) {
        throw new ConfigurationException("Fix quarkus.rest-client key-store/trust-store classpath path", e);
    }
    throw e;
}

Prevention

Keep certificate files in src/main/resources and reference them with exact 'classpath:<resource-path>' values
After adding a cert, verify it appears in the built jar before deploying
Add a startup test that opens the keystore resource from the classpath
Prefer 'file:' absolute paths for externally provisioned certs and 'classpath:' only for bundled ones

When it happens

Trigger: A @RegisterRestClient interface (or quarkus.rest-client.<config-key> properties) sets quarkus.rest-client.<key>.trust-store or key-store (or mp.rest-client equivalents) to 'classpath:some/path.p12' but the resource is missing from the packaged artifact; registerKeyStore/registerTrustStore invoke locateStream and getResourceAsStream returns null for both loaders.

Common situations: The PEM/PKCS12 file lives in src/main/resources but was excluded by build resource filtering or a .gitignore; the file is present in a test module but not in the dependency jar the app actually packages; path typo or wrong package directory (e.g. 'certs/keystore.p12' when the file is at resources root); a library relocation moved the resource to a different module; running in native mode where the resource was not included.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/bed408e3e0e380d0. Report an issue: GitHub.