quarkusio/quarkus · error · IllegalArgumentException

Failed to initialize trust store from " + keyStorePath

Error message

Failed to initialize trust store from " + keyStorePath

What it means

Thrown when KeyStore.getInstance() fails inside registerKeyStore — i.e. the configured key-store-type string is not a keystore type supported by any installed security provider. The builder wraps the KeyStoreException in this IllegalArgumentException naming the keystore path. Like the sibling error, the message misleadingly says 'trust store' although this path handles the client key store.

Source

Thrown at extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java:326

        Optional<String> keyStoreType = oneOf(restClientConfig.keyStoreType(), configRoot.keyStoreType());

        try {
            KeyStore keyStore = KeyStore.getInstance(keyStoreType.orElse("JKS"));
            if (keyStorePassword.isEmpty()) {
                throw new IllegalArgumentException("No password provided for keystore");
            }
            String password = keyStorePassword.get();

            try (InputStream input = locateStream(keyStorePath)) {
                keyStore.load(input, password.toCharArray());
            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {
                throw new IllegalArgumentException("Failed to initialize trust store from classpath resource " + keyStorePath,
                        e);
            }

            builder.keyStore(keyStore, password);
        } catch (KeyStoreException e) {
            throw new IllegalArgumentException("Failed to initialize trust store from " + keyStorePath, e);
        }
    }

    private void registerTrustStore(String trustStorePath, QuarkusRestClientBuilder builder) {
        Optional<String> maybeTrustStorePassword = oneOf(restClientConfig.trustStorePassword(),
                configRoot.trustStorePassword());
        Optional<String> maybeTrustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());

        try {
            KeyStore trustStore = KeyStore.getInstance(maybeTrustStoreType.orElse("JKS"));
            if (maybeTrustStorePassword.isEmpty()) {
                throw new IllegalArgumentException("No password provided for truststore");
            }
            String password = maybeTrustStorePassword.get();

            try (InputStream input = locateStream(trustStorePath)) {
                trustStore.load(input, password.toCharArray());
            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Correct the key-store-type value to a standard JDK type: JKS, PKCS12, or JCEKS
2. Remove the key-store-type property entirely to accept the JKS default only if the file is truly JKS
3. If using a non-JDK type like BCFKS, add the BouncyCastle dependency and register the provider in native mode
4. Confirm with keytool -list -storetype <type> that the JVM supports the configured type

Example fix

// before
quarkus.rest-client.my-client.key-store-type=PKS12
// after
quarkus.rest-client.my-client.key-store-type=PKCS12

String type = config.getOptionalValue("quarkus.rest-client.my-client.key-store-type", String.class).orElse("JKS");
try {
    KeyStore.getInstance(type);
} catch (KeyStoreException e) {
    throw new ConfigurationException("Unsupported key-store-type '" + type + "'. Use JKS, PKCS12 or JCEKS.", e);
}

static boolean isSupportedKeyStoreType(String type) {
    try {
        KeyStore.getInstance(type);
        return true;
    } catch (KeyStoreException e) {
        return false;
    }
}

try {
    return QuarkusRestClientBuilder.newBuilder().keyStore(path, password).build(MyClient.class);
} catch (IllegalArgumentException e) {
    if (e.getCause() instanceof KeyStoreException) {
        throw new ConfigurationException("key-store-type not supported by any provider: " + e.getMessage(), e);
    }
    throw e;
}

When it happens

Trigger: Setting quarkus.rest-client.<key>.key-store-type (or the global quarkus.restclient.* equivalent) to an unknown/misspelled type (e.g. 'jks ' with trailing space, 'PKS12', or a type requiring a provider not on the classpath such as BCFKS without BouncyCastle registered).

Common situations: Typo in the type name; using a PKCS12 file with type left as misspelled value; native-image build where the provider for an exotic type isn't registered; copy-pasting type names from other platforms (e.g. 'Windows-MY' on Linux).

Related errors

• No password provided for keystore
• Failed to initialize trust store from classpath resource " +
• Failed to load keystore
• No password provided for truststore
• Could not find a public, no-argument constructor for the hos

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/c82fda122c708b08. Report an issue: GitHub.