quarkusio/quarkus · error · IllegalArgumentException

No password provided for keystore

Error message

No password provided for keystore

What it means

registerKeyStore loads a keystore from the configured path and needs a password to load it. When neither the per-client config (quarkus.rest-client.<key>.keystore-password) nor the TLS config root provides a password, it throws this IllegalArgumentException before attempting to read the file. Quarkus does not default the keystore password.

Source

Thrown at extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java:313

        } catch (InstantiationException | IllegalAccessException | InvocationTargetException e) {
            throw new RuntimeException(
                    "Failed to instantiate hostname verifier class " + verifier
                            + ". Make sure it has a public, no-argument constructor",
                    e);
        } catch (ClassCastException e) {
            throw new RuntimeException("The provided hostname verifier " + verifier + " is not an instance of HostnameVerifier",
                    e);
        }
    }

    private void registerKeyStore(String keyStorePath, QuarkusRestClientBuilder builder) {
        Optional<String> keyStorePassword = oneOf(restClientConfig.keyStorePassword(), configRoot.keyStorePassword());
        Optional<String> keyStoreType = oneOf(restClientConfig.keyStoreType(), configRoot.keyStoreType());

        try {
            KeyStore keyStore = KeyStore.getInstance(keyStoreType.orElse("JKS"));
            if (keyStorePassword.isEmpty()) {
                throw new IllegalArgumentException("No password provided for keystore");
            }
            String password = keyStorePassword.get();

            try (InputStream input = locateStream(keyStorePath)) {
                keyStore.load(input, password.toCharArray());
            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {
                throw new IllegalArgumentException("Failed to initialize trust store from classpath resource " + keyStorePath,
                        e);
            }

            builder.keyStore(keyStore, password);
        } catch (KeyStoreException e) {
            throw new IllegalArgumentException("Failed to initialize trust store from " + keyStorePath, e);
        }
    }

    private void registerTrustStore(String trustStorePath, QuarkusRestClientBuilder builder) {
        Optional<String> maybeTrustStorePassword = oneOf(restClientConfig.trustStorePassword(),

View on GitHub (pinned to e1c734241f)

Solutions

1. Set quarkus.rest-client.<config-key>.keystore-password=<password> (or the equivalent TLS root property).
2. Supply the password via environment variable expansion, e.g. quarkus.rest-client.my-client.keystore-password=${KEYSTORE_PASSWORD}.
3. Confirm the password property name matches the same config key used for the keystore path.

Example fix

// before (application.properties)
quarkus.rest-client.my-client.key-store=/certs/client.jks
// missing password -> IllegalArgumentException

// after
quarkus.rest-client.my-client.key-store=/certs/client.jks
quarkus.rest-client.my-client.keystore-password=${KEYSTORE_PASSWORD}

boolean passwordSet = config.getOptionalValue("quarkus.rest-client.my-client.keystore-password", String.class).isPresent();
if (!passwordSet) throw new IllegalStateException("key-store configured but keystore-password missing");

null

try {
    // build client with keystore config
} catch (IllegalArgumentException e) {
    if (e.getMessage() != null && e.getMessage().contains("No password provided for keystore")) {
        // surface a clear config error to operators / abort startup with guidance
    } else throw e;
}

When it happens

Trigger: Setting a keystore path (key-store property) but omitting the corresponding keystore-password property for the same config key.

Common situations: Password kept only in an environment variable or vault not wired into config; typo between key-store and key-store-password property names; expecting a default password like 'changeit' which Quarkus does not assume.

Related errors

• Failed to initialize trust store from classpath resource " +
• Failed to initialize trust store from " + keyStorePath
• Failed to load keystore
• No password provided for truststore
• Could not find a public, no-argument constructor for the hos

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/d2653e0ae722a188. Report an issue: GitHub.