quarkusio/quarkus · error · IllegalArgumentException

No password provided for truststore

Error message

No password provided for truststore

What it means

RestClientBase.registerTrustStore() throws this when building the SSL context for a MicroProfile REST client and no truststore password is configured. A JKS/PKCS12 truststore cannot be loaded without its password, so the client aborts startup with IllegalArgumentException instead of failing later with an opaque SSL error.

Source

Thrown at extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java:202

            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {
                throw new IllegalArgumentException("Failed to initialize trust store from classpath resource " + keyStorePath,
                        e);
            }

            builder.keyStore(keyStore, password);
        } catch (KeyStoreException e) {
            throw new IllegalArgumentException("Failed to initialize trust store from " + keyStorePath, e);
        }
    }

    private void registerTrustStore(String trustStorePath, RestClientBuilder builder) {
        try {
            Optional<String> trustStoreType = oneOf(restClientConfig.trustStoreType(), configRoot.trustStoreType());
            KeyStore trustStore = KeyStore.getInstance(trustStoreType.orElse("JKS"));

            Optional<String> trustStorePassword = oneOf(restClientConfig.trustStorePassword(), configRoot.trustStorePassword());
            if (trustStorePassword.isEmpty()) {
                throw new IllegalArgumentException("No password provided for truststore");
            }
            String password = trustStorePassword.get();

            try (InputStream input = locateStream(trustStorePath)) {
                trustStore.load(input, password.toCharArray());
            } catch (IOException | CertificateException | NoSuchAlgorithmException e) {
                throw new IllegalArgumentException("Failed to initialize trust store from classpath resource " + trustStorePath,
                        e);
            }

            builder.trustStore(trustStore);
        } catch (KeyStoreException e) {
            throw new IllegalArgumentException("Failed to initialize trust store from " + trustStorePath, e);
        }
    }

    private InputStream locateStream(String path) throws FileNotFoundException {
        if (path.startsWith("classpath:")) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Set quarkus.rest-client.<key>.trust-store-password=<password> (or use the config-key variant) in application.properties
2. Verify the property prefix matches the @RegisterRestClient configKey or the fully-qualified interface name actually used
3. If the truststore truly has no password, set trust-store-password to an empty value or use a password-less store format such as PEM where supported

Example fix

// before (application.properties)
quarkus.rest-client.metrics-api.url=https://api.example.com
quarkus.rest-client.metrics-api.trust-store=file:/etc/certs/truststore.jks
// after
quarkus.rest-client.metrics-api.url=https://api.example.com
quarkus.rest-client.metrics-api.trust-store=file:/etc/certs/truststore.jks
quarkus.rest-client.metrics-api.trust-store-password=changeit

// before building the client
Config cfg = ConfigProvider.getConfig();
Optional<String> store = cfg.getOptionalValue("quarkus.rest-client.my-client.trust-store", String.class);
Optional<String> pw = cfg.getOptionalValue("quarkus.rest-client.my-client.trust-store-password", String.class);
if (store.isPresent() && pw.isEmpty()) {
    throw new IllegalStateException("trust-store set but trust-store-password missing for my-client");
}

When it happens

Trigger: quarkus.rest-client.<key>.trust-store (or trust-store-type) is set but neither quarkus.rest-client.<key>.trust-store-password nor quarkus.rest-client.<config-key>.trust-store-password is set; oneOf() finds no password in either the per-client config or the global RestClientsConfig.

Common situations: Copying truststore config from another project and forgetting the password property; password supplied under the wrong config key prefix; password defined only in a profile that is not active; migrating to Quarkus config where the MP property name changed.

Related errors

• Failed to initialize trust store from classpath resource ${t
• Failed to initialize trust store from ${trustStorePath}
• No password provided for keystore
• Failed to initialize trust store from classpath resource " +
• Failed to initialize trust store from " + keyStorePath

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/037eb5a88acdcfe2. Report an issue: GitHub.