What causes "Failed to initialize trust store from " + trustStorePath" in quarkusio/quarkus?

Fix trust-store-type to a standard type: JKS, PKCS12, or JCEKS

quarkusio/quarkus · error · IllegalArgumentException

Failed to initialize trust store from " + trustStorePath

Error message

Failed to initialize trust store from " + trustStorePath

What it means

Thrown when KeyStore.getInstance() fails for the trust store — the configured trust-store-type is not a type supported by any installed JCA security provider. The IllegalArgumentException names the trust store path. Same root cause family as error 1921 but for the trust store configuration.

Solutions

Fix trust-store-type to a standard type: JKS, PKCS12, or JCEKS
Remove the property to fall back to the JKS default (only if the file is JKS)
Add and register the required security provider (e.g. BouncyCastle) if a non-JDK type is needed, ensuring native-image support
Sanitize the config value: trim whitespace and compare against keytool -list -storetype <type> support

Example fix

// before
quarkus.restclient.trust-store-type=PCKS12
// after
quarkus.restclient.trust-store-type=PKCS12

Defensive patterns

Strategy: validation

Validate before calling

String type = config.getOptionalValue("quarkus.rest-client.my-client.trust-store-type", String.class).orElse("JKS");
try {
    KeyStore.getInstance(type);
} catch (KeyStoreException e) {
    throw new ConfigurationException("Unsupported trust-store-type '" + type + "'. Use JKS, PKCS12 or JCEKS.", e);
}

Type guard

static boolean isSupportedTrustStoreType(String type) {
    try {
        KeyStore.getInstance(type);
        return true;
    } catch (KeyStoreException e) {
        return false;
    }
}

Try / catch

try {
    return QuarkusRestClientBuilder.newBuilder().trustStore(path, password).build(MyClient.class);
} catch (IllegalArgumentException e) {
    if (e.getCause() instanceof KeyStoreException) {
        throw new ConfigurationException("trust-store-type not supported by any JCA provider: " + e.getMessage(), e);
    }
    throw e;
}

Prevention

Standardize on PKCS12 (or JKS) across services; avoid exotic provider types
Trim and lower-case type values coming from templated config to avoid typos/whitespace
If BouncyCastle types are required, add the dependency and register the provider for native builds
Validate the type once at application startup before any REST client is created

When it happens

Trigger: Setting quarkus.rest-client.<key>.trust-store-type (or global quarkus.restclient.trust-store-type) to an unsupported/misspelled value when the client is built, e.g. 'PCKS12', 'JKS ' with whitespace, or a provider-backed type whose provider is absent (especially in native images).

Common situations: Typo while copying type from another service; CI pipeline templating inserts an empty or wrong value; native-image build without BouncyCastle registration for BCFKS/PKCS12 variants from non-JDK providers; legacy configs referencing removed types.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/fb10e3c074699e56. Report an issue: GitHub.

Appendix: source

Thrown at extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java:351

        Optional<String> maybeTrustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());

        try {
            KeyStore trustStore = KeyStore.getInstance(maybeTrustStoreType.orElse("JKS"));
            if (maybeTrustStorePassword.isEmpty()) {
                throw new IllegalArgumentException("No password provided for truststore");
            }
            String password = maybeTrustStorePassword.get();

            try (InputStream input = locateStream(trustStorePath)) {
                trustStore.load(input, password.toCharArray());
            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {
                throw new IllegalArgumentException("Failed to initialize trust store from classpath resource " + trustStorePath,
                        e);
            }

            builder.trustStore(trustStore, password);
        } catch (KeyStoreException e) {
            throw new IllegalArgumentException("Failed to initialize trust store from " + trustStorePath, e);
        }
    }

    private InputStream locateStream(String path) throws FileNotFoundException {
        if (path.startsWith("classpath:")) {
            path = path.replaceFirst("classpath:", "");
            InputStream resultStream = Thread.currentThread().getContextClassLoader().getResourceAsStream(path);
            if (resultStream == null) {
                resultStream = getClass().getResourceAsStream(path);
            }
            if (resultStream == null) {
                throw new IllegalArgumentException(
                        "Classpath resource " + path + " not found for MicroProfile Rest Client SSL configuration");
            }
            return resultStream;
        } else {
            if (path.startsWith("file:")) {
                path = path.replaceFirst("file:", "");

View on GitHub (pinned to e1c734241f)