quarkusio/quarkus · error · IllegalArgumentException

Failed to initialize trust store from ${keyStorePath}

Error message

Failed to initialize trust store from ${keyStorePath}

What it means

KeyStore.getInstance(...) or related keystore setup operations threw a KeyStoreException while registering the client keystore, so the keystore could not be initialized from the configured path. Unlike error 1818 (load failure), this happens before/outside the stream load, typically because the requested keystore type is not supported by any provider.

Source

Thrown at extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java:191

            Optional<String> keyStoreType = oneOf(restClientConfig.keyStoreType(), configRoot.keyStoreType());
            KeyStore keyStore = KeyStore.getInstance(keyStoreType.orElse("JKS"));

            Optional<String> keyStorePassword = oneOf(restClientConfig.keyStorePassword(), configRoot.keyStorePassword());
            if (keyStorePassword.isEmpty()) {
                throw new IllegalArgumentException("No password provided for keystore");
            }
            String password = keyStorePassword.get();

            try (InputStream input = locateStream(keyStorePath)) {
                keyStore.load(input, password.toCharArray());
            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {
                throw new IllegalArgumentException("Failed to initialize trust store from classpath resource " + keyStorePath,
                        e);
            }

            builder.keyStore(keyStore, password);
        } catch (KeyStoreException e) {
            throw new IllegalArgumentException("Failed to initialize trust store from " + keyStorePath, e);
        }
    }

    private void registerTrustStore(String trustStorePath, RestClientBuilder builder) {
        try {
            Optional<String> trustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());
            KeyStore trustStore = KeyStore.getInstance(trustStoreType.orElse("JKS"));

            Optional<String> trustStorePassword = oneOf(restClientConfig.trustStorePassword(), configRoot.trustStorePassword());
            if (trustStorePassword.isEmpty()) {
                throw new IllegalArgumentException("No password provided for truststore");
            }
            String password = trustStorePassword.get();

            try (InputStream input = locateStream(trustStorePath)) {
                trustStore.load(input, password.toCharArray());
            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {
                throw new IllegalArgumentException("Failed to initialize trust store from classpath resource " + trustStorePath,

View on GitHub (pinned to e1c734241f)

Solutions

1. Correct the quarkus.rest-client.<name>.keystore-type value to a supported type (JKS, PKCS12)
2. Register the required JCA security provider or add its dependency (e.g. BouncyCastle for BCFKS)
3. Check the JVM/security provider configuration (java.security file) supports the requested type

Example fix

# before
quarkus.rest-client.my-client.keystore-type=PKCS1
# after
quarkus.rest-client.my-client.keystore-type=PKCS12

try {
    KeyStore.getInstance(keystoreType != null ? keystoreType : "JKS");
} catch (KeyStoreException e) {
    throw new IllegalStateException("Unsupported keystore type: " + keystoreType);
}

try {
    // create rest client
} catch (IllegalArgumentException e) {
    if (e.getCause() instanceof KeyStoreException) {
        log.error("Unsupported keystore type — check keystore-type config and security providers");
    }
}

When it happens

Trigger: registerKeyStore called with a keystore-type config value for which no JCA provider exists (KeyStoreException from KeyStore.getInstance), when building the KeyStore before reading the file.

Common situations: Typo in keystore-type (e.g. 'JKS ' with whitespace, 'PKCS1'); using a type requiring a provider (e.g. BCFKS) without the provider registered/dependency present; running on a JVM lacking that keystore implementation.

Related errors

• Failed to initialize trust store from classpath resource ${k
• Could not find a public, no-argument constructor for the hos
• Could not find hostname verifier class ${verifier}
• Failed to instantiate hostname verifier class ${verifier}. M
• The provided hostname verifier ${verifier} is not an instanc

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/700115cef421241a. Report an issue: GitHub.