quarkusio/quarkus · error · IllegalArgumentException

Failed to initialize trust store from " + trustStorePath

Error message

Failed to initialize trust store from " + trustStorePath

What it means

Thrown when KeyStore.getInstance() fails for the trust store — the configured trust-store-type is not a type supported by any installed JCA security provider. The IllegalArgumentException names the trust store path. Same root cause family as error 1921 but for the trust store configuration.

Source

Thrown at extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java:351

        Optional<String> maybeTrustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());

        try {
            KeyStore trustStore = KeyStore.getInstance(maybeTrustStoreType.orElse("JKS"));
            if (maybeTrustStorePassword.isEmpty()) {
                throw new IllegalArgumentException("No password provided for truststore");
            }
            String password = maybeTrustStorePassword.get();

            try (InputStream input = locateStream(trustStorePath)) {
                trustStore.load(input, password.toCharArray());
            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {
                throw new IllegalArgumentException("Failed to initialize trust store from classpath resource " + trustStorePath,
                        e);
            }

            builder.trustStore(trustStore, password);
        } catch (KeyStoreException e) {
            throw new IllegalArgumentException("Failed to initialize trust store from " + trustStorePath, e);
        }
    }

    private InputStream locateStream(String path) throws FileNotFoundException {
        if (path.startsWith("classpath:")) {
            path = path.replaceFirst("classpath:", "");
            InputStream resultStream = Thread.currentThread().getContextClassLoader().getResourceAsStream(path);
            if (resultStream == null) {
                resultStream = getClass().getResourceAsStream(path);
            }
            if (resultStream == null) {
                throw new IllegalArgumentException(
                        "Classpath resource " + path + " not found for MicroProfile Rest Client SSL configuration");
            }
            return resultStream;
        } else {
            if (path.startsWith("file:")) {
                path = path.replaceFirst("file:", "");

View on GitHub (pinned to e1c734241f)

Solutions

1. Fix trust-store-type to a standard type: JKS, PKCS12, or JCEKS
2. Remove the property to fall back to the JKS default (only if the file is JKS)
3. Add and register the required security provider (e.g. BouncyCastle) if a non-JDK type is needed, ensuring native-image support
4. Sanitize the config value: trim whitespace and compare against keytool -list -storetype <type> support

Example fix

// before
quarkus.restclient.trust-store-type=PCKS12
// after
quarkus.restclient.trust-store-type=PKCS12

String type = config.getOptionalValue("quarkus.rest-client.my-client.trust-store-type", String.class).orElse("JKS");
try {
    KeyStore.getInstance(type);
} catch (KeyStoreException e) {
    throw new ConfigurationException("Unsupported trust-store-type '" + type + "'. Use JKS, PKCS12 or JCEKS.", e);
}

static boolean isSupportedTrustStoreType(String type) {
    try {
        KeyStore.getInstance(type);
        return true;
    } catch (KeyStoreException e) {
        return false;
    }
}

try {
    return QuarkusRestClientBuilder.newBuilder().trustStore(path, password).build(MyClient.class);
} catch (IllegalArgumentException e) {
    if (e.getCause() instanceof KeyStoreException) {
        throw new ConfigurationException("trust-store-type not supported by any JCA provider: " + e.getMessage(), e);
    }
    throw e;
}

When it happens

Trigger: Setting quarkus.rest-client.<key>.trust-store-type (or global quarkus.restclient.trust-store-type) to an unsupported/misspelled value when the client is built, e.g. 'PCKS12', 'JKS ' with whitespace, or a provider-backed type whose provider is absent (especially in native images).

Common situations: Typo while copying type from another service; CI pipeline templating inserts an empty or wrong value; native-image build without BouncyCastle registration for BCFKS/PKCS12 variants from non-JDK providers; legacy configs referencing removed types.

Related errors

• No password provided for truststore
• Failed to initialize trust store from classpath resource " +
• Failed to load truststore
• Could not find a public, no-argument constructor for the hos
• Could not find hostname verifier class " + verifier

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/fb10e3c074699e56. Report an issue: GitHub.