quarkusio/quarkus · error · IllegalArgumentException

Failed to initialize trust store from classpath resource " +

Error message

Failed to initialize trust store from classpath resource " + trustStorePath

What it means

Thrown by registerTrustStore when KeyStore.load() on the configured trust store fails with IOException, CertificateException, or NoSuchAlgorithmException. The stream was located successfully, but the content could not be parsed as a keystore of the declared type or the integrity password is wrong. This is the trust-store counterpart of error 1920.

Source

Thrown at extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java:345

        }
    }

    private void registerTrustStore(String trustStorePath, QuarkusRestClientBuilder builder) {
        Optional<String> maybeTrustStorePassword = oneOf(restClientConfig.trustStorePassword(),
                configRoot.trustStorePassword());
        Optional<String> maybeTrustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());

        try {
            KeyStore trustStore = KeyStore.getInstance(maybeTrustStoreType.orElse("JKS"));
            if (maybeTrustStorePassword.isEmpty()) {
                throw new IllegalArgumentException("No password provided for truststore");
            }
            String password = maybeTrustStorePassword.get();

            try (InputStream input = locateStream(trustStorePath)) {
                trustStore.load(input, password.toCharArray());
            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {
                throw new IllegalArgumentException("Failed to initialize trust store from classpath resource " + trustStorePath,
                        e);
            }

            builder.trustStore(trustStore, password);
        } catch (KeyStoreException e) {
            throw new IllegalArgumentException("Failed to initialize trust store from " + trustStorePath, e);
        }
    }

    private InputStream locateStream(String path) throws FileNotFoundException {
        if (path.startsWith("classpath:")) {
            path = path.replaceFirst("classpath:", "");
            InputStream resultStream = Thread.currentThread().getContextClassLoader().getResourceAsStream(path);
            if (resultStream == null) {
                resultStream = getClass().getResourceAsStream(path);
            }
            if (resultStream == null) {
                throw new IllegalArgumentException(

View on GitHub (pinned to e1c734241f)

Solutions

1. Import the PEM certificate into a proper trust store: keytool -importcert -alias srv -file cert.pem -keystore truststore.p12 -storetype PKCS12
2. Verify the password with keytool -list -keystore <path> and fix quarkus.rest-client.<key>.trust-store-password
3. Align trust-store-type with the real file format (PKCS12 vs JKS)
4. Re-download/recreate the truststore file if it is corrupt, empty, or not a keystore

Example fix

// before
quarkus.rest-client.my-client.trust-store=file:certs/server-cert.pem
// after
# first: keytool -importcert -alias server -file certs/server-cert.pem -keystore certs/truststore.p12 -storetype PKCS12
quarkus.rest-client.my-client.trust-store=file:certs/truststore.p12
quarkus.rest-client.my-client.trust-store-type=PKCS12
quarkus.rest-client.my-client.trust-store-password=changeit

String tsPath = config.getValue("quarkus.rest-client.my-client.trust-store");
String tsPass = config.getValue("quarkus.rest-client.my-client.trust-store-password");
String tsType = config.getOptionalValue("quarkus.rest-client.my-client.trust-store-type", String.class).orElse("JKS");
try (var in = new FileInputStream(tsPath.replaceFirst("file:", ""))) {
    KeyStore.getInstance(tsType).load(in, tsPass.toCharArray());
    System.out.println("Trust store OK: " + tsPath);
} catch (Exception e) {
    throw new IllegalStateException("Invalid trust store (wrong password, PEM file, or type mismatch): " + e.getMessage(), e);
}

static boolean isLoadableTrustStore(String path, String password, String type) {
    try (var in = new FileInputStream(path)) {
        KeyStore.getInstance(type).load(in, password.toCharArray());
        return true;
    } catch (Exception e) {
        return false;
    }
}

try {
    MyClient client = QuarkusRestClientBuilder.newBuilder()
            .baseUri(uri)
            .trustStore(trustStorePath, trustStorePassword)
            .build(MyClient.class);
} catch (IllegalArgumentException e) {
    if (e.getMessage() != null && e.getMessage().contains(trustStorePath)) {
        throw new ConfigurationException(
            "Trust store could not be loaded. Ensure it is a real JKS/PKCS12 store (not PEM) and the password/type match: "
            + e.getMessage(), e);
    }
    throw e;
}

When it happens

Trigger: quarkus.rest-client.<key>.trust-store points to a PEM certificate instead of a JKS/PKCS12 trust store, the trust-store-type doesn't match the actual format, or trust-store-password is wrong, when the REST client is created.

Common situations: Downloading a server certificate (PEM) and pointing trust-store at it directly instead of importing it into a keystore with keytool; dev/prod truststore passwords differ; a .jks file got re-saved as PKCS12 (or vice versa) by a pipeline; empty or HTML error page saved as the truststore file.

Related errors

• No password provided for truststore
• Failed to initialize trust store from " + trustStorePath
• Failed to load truststore
• Could not find a public, no-argument constructor for the hos
• Could not find hostname verifier class " + verifier

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/c1efdc6a0bd8051e. Report an issue: GitHub.