quarkusio/quarkus · error · IllegalArgumentException

No password provided for truststore

Error message

No password provided for truststore

What it means

RestClientCDIDelegateBuilder.registerTrustStore requires a password when loading a trust store and throws IllegalArgumentException if neither quarkus.rest-client.<key>.trust-store-password nor the global quarkus.restclient.trust-store-password property is set. Unlike a java.net.ssl context where truststore passwords are often ignored, this builder passes the password to KeyStore.load, so it treats a missing password as a hard configuration error.

Source

Thrown at extensions/resteasy-reactive/rest-client/runtime/src/main/java/io/quarkus/rest/client/reactive/runtime/RestClientCDIDelegateBuilder.java:338

                throw new IllegalArgumentException("Failed to initialize trust store from classpath resource " + keyStorePath,
                        e);
            }

            builder.keyStore(keyStore, password);
        } catch (KeyStoreException e) {
            throw new IllegalArgumentException("Failed to initialize trust store from " + keyStorePath, e);
        }
    }

    private void registerTrustStore(String trustStorePath, QuarkusRestClientBuilder builder) {
        Optional<String> maybeTrustStorePassword = oneOf(restClientConfig.trustStorePassword(),
                configRoot.trustStorePassword());
        Optional<String> maybeTrustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());

        try {
            KeyStore trustStore = KeyStore.getInstance(maybeTrustStoreType.orElse("JKS"));
            if (maybeTrustStorePassword.isEmpty()) {
                throw new IllegalArgumentException("No password provided for truststore");
            }
            String password = maybeTrustStorePassword.get();

            try (InputStream input = locateStream(trustStorePath)) {
                trustStore.load(input, password.toCharArray());
            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {
                throw new IllegalArgumentException("Failed to initialize trust store from classpath resource " + trustStorePath,
                        e);
            }

            builder.trustStore(trustStore, password);
        } catch (KeyStoreException e) {
            throw new IllegalArgumentException("Failed to initialize trust store from " + trustStorePath, e);
        }
    }

    private InputStream locateStream(String path) throws FileNotFoundException {
        if (path.startsWith("classpath:")) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Add quarkus.rest-client.<key>.trust-store-password (or quarkus.restclient.trust-store-password globally) with the actual truststore password
2. If the truststore genuinely has no integrity password, create the file with keytool and a known password (PKCS12/JKS require one on load here)
3. Check SmallRye config logs / dev mode config editor to confirm the property name matches the client config key exactly
4. If a password is truly unavailable, load the trust store yourself in code and call builder.trustStore with the certificates instead of using config-based registration

Example fix

// before
quarkus.rest-client.my-client.trust-store=file:certs/truststore.p12
// after
quarkus.rest-client.my-client.trust-store=file:certs/truststore.p12
quarkus.rest-client.my-client.trust-store-password=changeit

var cfg = ConfigProvider.getConfig();
var pw = cfg.getOptionalValue("quarkus.rest-client.my-client.trust-store-password", String.class)
        .or(() -> cfg.getOptionalValue("quarkus.restclient.trust-store-password", String.class));
if (pw.isEmpty()) {
    throw new ConfigurationException(
        "quarkus.rest-client.my-client.trust-store-password is required when a trust-store is configured");
}

static boolean hasTrustStorePassword(org.eclipse.microprofile.config.Config config, String clientKey) {
    return config.getOptionalValue("quarkus.rest-client." + clientKey + ".trust-store-password", String.class).isPresent()
        || config.getOptionalValue("quarkus.restclient.trust-store-password", String.class).isPresent();
}

try {
    return clientFactory.create(MyClient.class);
} catch (IllegalArgumentException e) {
    if ("No password provided for truststore".equals(e.getMessage())) {
        throw new ConfigurationException(
            "Set quarkus.rest-client.<key>.trust-store-password (trust stores need a password here even if load-only)", e);
    }
    throw e;
}

When it happens

Trigger: Creating a @RegisterRestClient client (or calling QuarkusRestClientBuilder manually routed through configureTLSFromProperties) with trust-store and trust-store-type configured but no trust-store-password property present in either the per-client or global quarkus.restclient scope.

Common situations: Assuming PKCS12 trust stores can omit the password (JDK validates integrity, so a password is needed); the property was defined under a wrong prefix (e.g. quarkus.rest-client."my-client" quoting/typo mismatch so the per-client value isn't picked up); config moved to environment variables whose name doesn't map (dots to underscores).

Related errors

• Failed to initialize trust store from classpath resource " +
• Failed to initialize trust store from " + trustStorePath
• Failed to load truststore
• Could not find a public, no-argument constructor for the hos
• Could not find hostname verifier class " + verifier

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/3838d4e8590fac35. Report an issue: GitHub.