Question
PKIX path building failed after truststore update in Quarkus
Neel Lane
0 reputation · 13 Jun 2022, 17:53 UTC
105.1K views
Loading…
0 reputation · 13 Jun 2022, 17:53 UTC
Determine whether a running Quarkus application can recognize newly added CA certificates in its truststore without requiring a full restart.
Quarkus relies on the default Java SSLContext unless a custom configuration is provided. The documentation states that truststore changes are not picked up at runtime, but it does not specify whether any extension or configuration flag exists to trigger a reload. This behavior may differ between JVM mode and native executables, where static networking libraries could further affect certificate reloading.
Specific questions:
35275 reputation · 13 Jun 2022, 18:34 UTC
A running Quarkus application cannot recognize newly added CA certificates in the truststore without a restart. There is no supported Quarkus API or configuration property to programmatically reload the JVM's default SSLContext or truststore at runtime.
The PKIX path building failed error occurs because the Java Virtual Machine (JVM) loads the truststore into memory during the initialization of the SSLContext. Once the TrustManagerFactory is initialized, it does not monitor the underlying file for changes. Because Quarkus relies on the standard JVM networking stack for its REST clients and server configurations, any updates to the cacerts file or a custom truststore specified via javax.net.ssl.trustStore remain invisible to the active process.
To resolve the failure and verify the truststore state, follow these steps:
quarkuskeytool:
keytool -list -v -keystore /path/to/truststore -alias your_cert_alias-Djavax.net.debug=ssl,handshakeSSLContext and load the updated certificates.SSLContext in all active HTTP clients.cacerts or the system truststore. If certificates are baked into the image at build time, a full rebuild and redeploy are required. If the native image is configured to use the system truststore, a restart of the binary is still required to refresh the memory state.Diagnostic Detail Needed: Are you using a custom SSLContext bean or the default Quarkus REST Client configuration? If you have implemented a custom SSLContext, a programmatic refresh may be possible by rotating the bean, but this is not the default Quarkus behavior.
Use comments to ask for clarification. Post a solution as an answer.
35,275 reputation · 13 Jun 2022, 18:42 UTC
To expand on the distinction between JVM and Native modes, it is important to note that GraalVM native executables handle truststores differently depending on the build configuration. While JVM mode relies on the dynamic JSSE provider, native images often bake in specific security configurations at build time.
If the application is compiled as a native image, updating the external cacerts file may still require a restart, but the underlying mechanism is more rigid. In some native configurations, the truststore is partially internalized or mapped to a specific system path that cannot be overridden by System.setProperty() at runtime. For those utilizing native mode, verify the --enable-all-security-services flag during build to ensure the runtime still respects the external truststore path rather than relying solely on a static snapshot of the certificates available during the build process.