quarkusio/quarkus · error · IllegalArgumentException

Failed to initialize trust store from classpath resource ${t

Error message

Failed to initialize trust store from classpath resource ${trustStorePath}

What it means

registerTrustStore() located the truststore stream and called KeyStore.load(), but loading failed with IOException, CertificateException, or NoSuchAlgorithmException. Quarkus wraps the cause in an IllegalArgumentException naming the classpath resource path, meaning the file was found but its content or format is wrong for the declared store type.

Source

Thrown at extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java:209

            throw new IllegalArgumentException("Failed to initialize trust store from " + keyStorePath, e);
        }
    }

    private void registerTrustStore(String trustStorePath, RestClientBuilder builder) {
        try {
            Optional<String> trustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());
            KeyStore trustStore = KeyStore.getInstance(trustStoreType.orElse("JKS"));

            Optional<String> trustStorePassword = oneOf(restClientConfig.trustStorePassword(), configRoot.trustStorePassword());
            if (trustStorePassword.isEmpty()) {
                throw new IllegalArgumentException("No password provided for truststore");
            }
            String password = trustStorePassword.get();

            try (InputStream input = locateStream(trustStorePath)) {
                trustStore.load(input, password.toCharArray());
            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {
                throw new IllegalArgumentException("Failed to initialize trust store from classpath resource " + trustStorePath,
                        e);
            }

            builder.trustStore(trustStore);
        } catch (KeyStoreException e) {
            throw new IllegalArgumentException("Failed to initialize trust store from " + trustStorePath, e);
        }
    }

    private InputStream locateStream(String path) throws FileNotFoundException {
        if (path.startsWith("classpath:")) {
            path = path.replaceFirst("classpath:", "");
            InputStream resultStream = Thread.currentThread().getContextClassLoader().getResourceAsStream(path);
            if (resultStream == null) {
                resultStream = getClass().getResourceAsStream(path);
            }
            if (resultStream == null) {
                throw new IllegalArgumentException(

View on GitHub (pinned to e1c734241f)

Solutions

1. Check the wrapped cause (IOException/CertificateException) to distinguish wrong password from wrong format
2. Set quarkus.rest-client.<key>.trust-store-type=PKCS12 if the file is PKCS12, or re-export the store as JKS
3. Confirm the file is a real keystore: keytool -list -keystore <file> -storetype <type>
4. Disable Maven resource filtering for binary keystore files (maven-resources-plugin filtering=false on binaries)

Example fix

// before (application.properties)
quarkus.rest-client.external-api.trust-store=classpath:certs/trust.pem
// after — declare the correct type or convert the file
quarkus.rest-client.external-api.trust-store=classpath:certs/truststore.p12
quarkus.rest-client.external-api.trust-store-type=PKCS12
quarkus.rest-client.external-api.trust-store-password=changeit

// verify the store loads before configuring the client
try (InputStream in = getClass().getResourceAsStream("/certs/truststore.p12")) {
    KeyStore ks = KeyStore.getInstance("PKCS12");
    ks.load(in, "changeit".toCharArray()); // fails early, at startup, with the real cause
} catch (Exception e) {
    throw new IllegalStateException("Bad truststore: " + e.getMessage(), e);
}

When it happens

Trigger: trust-store path uses the classpath: scheme, the stream resolves, but trustStore.load() fails — corrupted/truncated file, wrong password, or trust-store-type (e.g. JKS vs PKCS12) does not match the actual file format.

Common situations: A PEM certificate copied into a .jks-named file while type defaults to JKS; store exported with a different password than configured; resource filtered/mangled by Maven resource filtering; wrong file accidentally placed at that classpath location.

Related errors

• No password provided for truststore
• Classpath resource ${path} not found for MicroProfile Rest C
• Classpath resource " + path + " not found for MicroProfile R
• Multiple RestClientBuilderFactory implementations found: ${s
• Failed to initialized SSL context

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/81b495101f5e4fa0. Report an issue: GitHub.