quarkusio/quarkus · error · IllegalArgumentException

Failed to initialize trust store from classpath resource " +

Error message

Failed to initialize trust store from classpath resource " + keyStorePath

What it means

Quarkus's RestClientCDIDelegateBuilder throws this IllegalArgumentException when it cannot load the client's keystore file into a java.security.KeyStore while building the REST client from MicroProfile/Quarkus TLS config. Despite the message text saying 'trust store', this instance is the key store (registerKeyStore). The KeyStore.load() call failed with IOException, CertificateException, or NoSuchAlgorithmException — typically because the file is missing/corrupt, the password is wrong, or the declared type (default JKS) does not match the actual format.

Source

Thrown at extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java:320

                    e);
        }
    }

    private void registerKeyStore(String keyStorePath, QuarkusRestClientBuilder builder) {
        Optional<String> keyStorePassword = oneOf(restClientConfig.keyStorePassword(), configRoot.keyStorePassword());
        Optional<String> keyStoreType = oneOf(restClientConfig.keyStoreType(), configRoot.keyStoreType());

        try {
            KeyStore keyStore = KeyStore.getInstance(keyStoreType.orElse("JKS"));
            if (keyStorePassword.isEmpty()) {
                throw new IllegalArgumentException("No password provided for keystore");
            }
            String password = keyStorePassword.get();

            try (InputStream input = locateStream(keyStorePath)) {
                keyStore.load(input, password.toCharArray());
            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {
                throw new IllegalArgumentException("Failed to initialize trust store from classpath resource " + keyStorePath,
                        e);
            }

            builder.keyStore(keyStore, password);
        } catch (KeyStoreException e) {
            throw new IllegalArgumentException("Failed to initialize trust store from " + keyStorePath, e);
        }
    }

    private void registerTrustStore(String trustStorePath, QuarkusRestClientBuilder builder) {
        Optional<String> maybeTrustStorePassword = oneOf(restClientConfig.trustStorePassword(),
                configRoot.trustStorePassword());
        Optional<String> maybeTrustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());

        try {
            KeyStore trustStore = KeyStore.getInstance(maybeTrustStoreType.orElse("JKS"));
            if (maybeTrustStorePassword.isEmpty()) {
                throw new IllegalArgumentException("No password provided for truststore");

View on GitHub (pinned to e1c734241f)

Solutions

1. Verify the password in quarkus.rest-client.<key>.key-store-password matches the actual keystore password
2. Check quarkus.rest-client.<key>.key-store-type matches the file format (e.g. PKCS12 for .p12 files instead of the JKS default)
3. Validate the file with: keytool -list -keystore <path> -storetype <type> — if keytool fails, the file or password is wrong
4. Re-export/regenerate the keystore with keytool if it is corrupt or in the wrong format

Example fix

// before
quarkus.rest-client.my-client.key-store-type=JKS
quarkus.rest-client.my-client.key-store-password=changeme
// after (file is actually PKCS12)
quarkus.rest-client.my-client.key-store-type=PKCS12
quarkus.rest-client.my-client.key-store-password=correct-password

import java.io.FileInputStream;
import java.security.KeyStore;

// run at startup, before the client is created
String path = config.getValue("quarkus.rest-client.my-client.key-store");
String pass = config.getValue("quarkus.rest-client.my-client.key-store-password");
String type = config.getOptionalValue("quarkus.rest-client.my-client.key-store-type", String.class).orElse("JKS");
try (var in = path.startsWith("classpath:")
        ? Thread.currentThread().getContextClassLoader().getResourceAsStream(path.replaceFirst("classpath:", ""))
        : new FileInputStream(path.replaceFirst("file:", ""))) {
    KeyStore.getInstance(type).load(in, pass.toCharArray()); // throws same way if bad
    System.out.println("Key store OK: " + path);
} catch (Exception e) {
    throw new IllegalStateException("Invalid key store config: " + e.getMessage(), e);
}

static boolean isValidKeyStoreConfig(String path, String password, String type) {
    if (path == null || password == null || type == null) return false;
    try {
        try (var in = new FileInputStream(path)) {
            KeyStore.getInstance(type).load(in, password.toCharArray());
        }
        return true;
    } catch (Exception e) {
        return false;
    }
}

try {
    MyClient client = QuarkusRestClientBuilder.newBuilder()
            .baseUri(uri)
            .keyStore(keyStorePath, password)
            .build(MyClient.class);
} catch (IllegalArgumentException e) {
    if (e.getMessage() != null && e.getMessage().startsWith("Failed to initialize trust store")) {
        throw new ConfigurationException("Check key-store-password and key-store-type: " + e.getMessage(), e);
    }
    throw e;
}

When it happens

Trigger: quarkus.rest-client.<key>.key-store-type (or quarkus.restclient.key-store-type) set to a type that doesn't match the file, or a wrong key-store-password, or a file that is corrupt/empty/not a keystore, passed to registerKeyStore during client creation via configureTLSFromProperties. Note a truly missing path is caught earlier by locateStream, so this error means the stream opened but load() failed.

Common situations: Password typo or password rotated in the vault but not in application.properties; file regenerated as PKCS12 while config still says JKS; truncated or text-format certificate exported instead of a keystore; wrong keystore used for a different alias/environment (dev vs prod).

Related errors

• No password provided for keystore
• Failed to initialize trust store from " + keyStorePath
• Failed to load keystore
• No password provided for truststore
• Could not find a public, no-argument constructor for the hos

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/b2a4810af4fa95a5. Report an issue: GitHub.