quarkusio/quarkus · error · IllegalArgumentException

Failed to initialize trust store from ${trustStorePath}

Error message

Failed to initialize trust store from ${trustStorePath}

What it means

Thrown by registerTrustStore() when KeyStore.getInstance() itself fails with KeyStoreException, meaning the JVM has no provider for the requested trust-store type. Unlike the load failure, this happens before any file is read — the store type string is the problem.

Source

Thrown at extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java:215

            Optional<String> trustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());
            KeyStore trustStore = KeyStore.getInstance(trustStoreType.orElse("JKS"));

            Optional<String> trustStorePassword = oneOf(restClientConfig.trustStorePassword(), configRoot.trustStorePassword());
            if (trustStorePassword.isEmpty()) {
                throw new IllegalArgumentException("No password provided for truststore");
            }
            String password = trustStorePassword.get();

            try (InputStream input = locateStream(trustStorePath)) {
                trustStore.load(input, password.toCharArray());
            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {
                throw new IllegalArgumentException("Failed to initialize trust store from classpath resource " + trustStorePath,
                        e);
            }

            builder.trustStore(trustStore);
        } catch (KeyStoreException e) {
            throw new IllegalArgumentException("Failed to initialize trust store from " + trustStorePath, e);
        }
    }

    private InputStream locateStream(String path) throws FileNotFoundException {
        if (path.startsWith("classpath:")) {
            path = path.replaceFirst("classpath:", "");
            InputStream resultStream = Thread.currentThread().getContextClassLoader().getResourceAsStream(path);
            if (resultStream == null) {
                resultStream = getClass().getResourceAsStream(path);
            }
            if (resultStream == null) {
                throw new IllegalArgumentException(
                        "Classpath resource " + path + " not found for MicroProfile Rest Client SSL configuration");
            }
            return resultStream;
        } else {
            if (path.startsWith("file:")) {
                path = path.replaceFirst("file:", "");

View on GitHub (pinned to e1c734241f)

Solutions

1. Fix the trust-store-type value — use JKS or PKCS12 which every JVM supports
2. List available types via Security.getAlgorithms("KeyStore") in jshell and match exactly
3. If running native, ensure the keystore provider is registered (quarkus.ssl.native=true and default providers present)

Example fix

// before (application.properties)
quarkus.rest-client.billing.trust-store-type=pkcs 12
// after
quarkus.rest-client.billing.trust-store-type=PKCS12

// ensure the type is supported by the runtime JVM
String type = ConfigProvider.getConfig()
    .getOptionalValue("quarkus.rest-client.my-client.trust-store-type", String.class).orElse("JKS");
if (!java.security.Security.getAlgorithms("KeyStore").contains(type)) {
    throw new IllegalStateException("Unsupported keystore type: " + type);
}

When it happens

Trigger: quarkus.rest-client.<key>.trust-store-type (or the global configRoot value) names a keystore type unsupported by the installed JCE providers, e.g. a typo like 'JKS ' or an exotic type such as 'WINDOWS-MY' on a headless Linux runtime.

Common situations: Typo in trust-store-type; type valid on a developer's desktop JDK but absent in the container's slimmer JVM; native-image build where the keystore provider was not registered.

Related errors

• No password provided for truststore
• Trust options have already been set
• Key cert options have already been set
• Failed to create Keycloak Admin client SSLContext
• Failed to load keystore

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/ba9f6d87ab35613b. Report an issue: GitHub.