quarkusio/quarkus · error · IllegalArgumentException

No password provided for keystore

Error message

No password provided for keystore

What it means

When a key store path is configured for a REST client, RestClientBase reads the keystore password from config and requires it to be present. This IllegalArgumentException is thrown when neither the rest-client-specific nor the global keystore password config property is set. Without the password the KeyStore cannot be loaded.

Source

Thrown at extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java:178

        } catch (InstantiationException | IllegalAccessException | InvocationTargetException e) {
            throw new RuntimeException(
                    "Failed to instantiate hostname verifier class " + verifier
                            + ". Make sure it has a public, no-argument constructor",
                    e);
        } catch (ClassCastException e) {
            throw new RuntimeException("The provided hostname verifier " + verifier + " is not an instance of HostnameVerifier",
                    e);
        }
    }

    private void registerKeyStore(String keyStorePath, RestClientBuilder builder) {
        try {
            Optional<String> keyStoreType = oneOf(restClientConfig.keyStoreType(), configRoot.keyStoreType());
            KeyStore keyStore = KeyStore.getInstance(keyStoreType.orElse("JKS"));

            Optional<String> keyStorePassword = oneOf(restClientConfig.keyStorePassword(), configRoot.keyStorePassword());
            if (keyStorePassword.isEmpty()) {
                throw new IllegalArgumentException("No password provided for keystore");
            }
            String password = keyStorePassword.get();

            try (InputStream input = locateStream(keyStorePath)) {
                keyStore.load(input, password.toCharArray());
            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {
                throw new IllegalArgumentException("Failed to initialize trust store from classpath resource " + keyStorePath,
                        e);
            }

            builder.keyStore(keyStore, password);
        } catch (KeyStoreException e) {
            throw new IllegalArgumentException("Failed to initialize trust store from " + keyStorePath, e);
        }
    }

    private void registerTrustStore(String trustStorePath, RestClientBuilder builder) {
        try {

View on GitHub (pinned to e1c734241f)

Solutions

1. Set quarkus.rest-client.<name>.keystore-password (or %env profile equivalent) alongside keystore-path
2. Supply the password via an environment variable or credentials provider instead of hardcoding
3. Double-check the exact config key spelling for your Quarkus version

Example fix

# before
quarkus.rest-client.my-client.keystore-path=certs/client.jks
# after
quarkus.rest-client.my-client.keystore-path=certs/client.jks
quarkus.rest-client.my-client.keystore-password=changeit

if (config.keystorePath().isPresent() && config.keystorePassword().isEmpty()) {
    throw new IllegalStateException("keystore-path is set but keystore-password is missing");
}

try {
    // client creation
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("No password provided for keystore")) {
        log.error("Set quarkus.rest-client.<name>.keystore-password");
    }
}

When it happens

Trigger: Configuring quarkus.rest-client.<name>.keystore-path (or keystore config) without setting quarkus.rest-client.<name>.keystore-password (or the global rest-client keystore-password).

Common situations: Setting the keystore path but forgetting the password property; password provided under a differently-named/older config key; using an env/secret source that didn't resolve so the Optional came back empty.

Related errors

• Trust options have already been set
• Key cert options have already been set
• Failed to create Keycloak Admin client SSLContext
• Could not configure MongoDB client with TLS registry
• quarkus.datasource.reactive.hostname-verification-algorithm

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/b1339100329dbca0. Report an issue: GitHub.