quarkusio/quarkus · error · IllegalArgumentException

Failed to initialize trust store from classpath resource ${k

Error message

Failed to initialize trust store from classpath resource ${keyStorePath}

What it means

The keystore was created and a password was present, but loading the keystore from the located stream failed with an IOException, CertificateException, or NoSuchAlgorithmException. The path in the message is the configured keystore resource; the cause contains the underlying reason (bad password, corrupt file, unsupported algorithm).

Source

Thrown at extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java:185

                    e);
        }
    }

    private void registerKeyStore(String keyStorePath, RestClientBuilder builder) {
        try {
            Optional<String> keyStoreType = oneOf(restClientConfig.keyStoreType(), configRoot.keyStoreType());
            KeyStore keyStore = KeyStore.getInstance(keyStoreType.orElse("JKS"));

            Optional<String> keyStorePassword = oneOf(restClientConfig.keyStorePassword(), configRoot.keyStorePassword());
            if (keyStorePassword.isEmpty()) {
                throw new IllegalArgumentException("No password provided for keystore");
            }
            String password = keyStorePassword.get();

            try (InputStream input = locateStream(keyStorePath)) {
                keyStore.load(input, password.toCharArray());
            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {
                throw new IllegalArgumentException("Failed to initialize trust store from classpath resource " + keyStorePath,
                        e);
            }

            builder.keyStore(keyStore, password);
        } catch (KeyStoreException e) {
            throw new IllegalArgumentException("Failed to initialize trust store from " + keyStorePath, e);
        }
    }

    private void registerTrustStore(String trustStorePath, RestClientBuilder builder) {
        try {
            Optional<String> trustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());
            KeyStore trustStore = KeyStore.getInstance(trustStoreType.orElse("JKS"));

            Optional<String> trustStorePassword = oneOf(restClientConfig.trustStorePassword(), configRoot.trustStorePassword());
            if (trustStorePassword.isEmpty()) {
                throw new IllegalArgumentException("No password provided for truststore");
            }

View on GitHub (pinned to e1c734241f)

Solutions

Verify the keystore password is correct
Set quarkus.rest-client.<name>.keystore-type to the actual format (e.g. PKCS12) instead of the default JKS
Check the file isn't corrupted or filtered during build (exclude binary resources from resource filtering)
Regenerate the keystore with keytool if the file is damaged

Example fix

# before
quarkus.rest-client.my-client.keystore-path=certs/client.p12
# after
quarkus.rest-client.my-client.keystore-path=certs/client.p12
quarkus.rest-client.my-client.keystore-type=PKCS12

Defensive patterns

Strategy: try-catch

Validate before calling

try (InputStream in = getClass().getResourceAsStream(keystorePath)) {
    KeyStore ks = KeyStore.getInstance(keystoreType != null ? keystoreType : "JKS");
    ks.load(in, password.toCharArray()); // same check the library performs
}

Try / catch

try {
    // create rest client
} catch (IllegalArgumentException e) {
    if (e.getMessage().startsWith("Failed to initialize trust store")) {
        log.error("Keystore load failed: " + e.getCause(), e.getCause());
    }
}

Prevention

Verify the keystore password with keytool -list before deploying
Set keystore-type to match the file format (PKCS12 vs JKS)
Exclude binary resources from build-time filtering to avoid corruption
Test keystore loading in CI on the same JVM version used in production

When it happens

Trigger: registerKeyStore called with a path resolvable by locateStream, but keyStore.load(input, password) throws — wrong password ('Given final block not properly padded' for PKCS12/JKS), corrupted keystore file, certificate format issues, or wrong keystore type for the file format.

Common situations: Typo in the keystore password; keystore saved in a different format than the configured type (default JKS vs actual PKCS12); truncated or binary-mangled resource after resource filtering by Maven/Gradle; JVM not supporting the specified keystore type/algorithm.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/cfcbe9eda63fed9e. Report an issue: GitHub.