apache/pulsar · error · IllegalArgumentException

cert/key file path or cert/key stream must be present

Error message

cert/key file path or cert/key stream must be present

What it means

AuthenticationTls.getAuthData() builds TLS credentials from either file paths (setTlsFilePath) or stream providers (setCertStreamProvider/setKeyStreamProvider). If, after configuration, none of cert path/key path, cert/key streams, or a trust store stream provider combination is present, it throws this IllegalArgumentException because it cannot construct AuthenticationDataTls without any certificate/key material.

Source

Thrown at pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationTls.java:91

    @Override
    public String getAuthMethodName() {
        return AUTH_METHOD_NAME;
    }

    @SuppressWarnings("deprecation")
    @Override
    public AuthenticationDataProvider getAuthData() throws PulsarClientException {
        try {
            if (certFilePath != null && keyFilePath != null) {
                return new AuthenticationDataTls(certFilePath, keyFilePath);
            } else if (certStreamProvider != null && keyStreamProvider != null) {
                return new AuthenticationDataTls(certStreamProvider, keyStreamProvider, trustStoreStreamProvider);
            }
        } catch (Exception e) {
            throw new PulsarClientException(e);
        }
        throw new IllegalArgumentException("cert/key file path or cert/key stream must be present");
    }

    @Override
    public void configure(String encodedAuthParamString) {
        Map<String, String> authParamsMap = null;
        try {
            authParamsMap = AuthenticationUtil.configureFromJsonString(encodedAuthParamString);
        } catch (Exception e) {
            // auth-param is not in json format
        }
        authParamsMap = (authParamsMap == null || authParamsMap.isEmpty())
                ? AuthenticationUtil.configureFromPulsar1AuthParamString(encodedAuthParamString)
                : authParamsMap;
        setAuthParams(authParamsMap);
    }

    @Override
    @Deprecated

View on GitHub (pinned to 820761864e)

Solutions

Call authentication.setTlsFilePath(certFile, keyFile) with valid existing file paths before getAuthData().
Alternatively call setCertStreamProvider(...) and setKeyStreamProvider(...) with InputStream suppliers.
If using configure(authParams), ensure the params string contains both tlsCertFile and tlsKeyFile keys with non-blank values.

Example fix

// before
AuthenticationTls auth = new AuthenticationTls();
PulsarClient client = PulsarClient.builder().authentication(auth).build(); // throws
// after
AuthenticationTls auth = new AuthenticationTls();
auth.setTlsFilePath("/etc/pulsar/cert.pem", "/etc/pulsar/key.pem");
PulsarClient client = PulsarClient.builder().authentication(auth).build();

Defensive patterns

Strategy: validation

Validate before calling

AuthenticationTls auth = new AuthenticationTls();
if (certFile != null && keyFile != null && new File(certFile).exists() && new File(keyFile).exists()) {
    auth.setTlsFilePath(certFile, keyFile);
} else if (certStreamProvider != null && keyStreamProvider != null) {
    auth.setCertStreamProvider(certStreamProvider);
    auth.setKeyStreamProvider(keyStreamProvider);
} else {
    throw new IllegalStateException("TLS auth requires either cert/key file paths or cert/key stream providers");
}

Try / catch

try {
    AuthenticationDataTls data = (AuthenticationDataTls) auth.getAuthData();
} catch (IllegalArgumentException e) {
    log.error("TLS auth not configured: {}", e.getMessage());
    throw new ConfigurationException("Set tlsCertFile/tlsKeyFile or stream providers", e);
}

Prevention

Always call setTlsFilePath or the stream-provider setters immediately after constructing AuthenticationTls.
Check both cert and key are set — one alone is not enough.
Validate file existence before building the client.

When it happens

Trigger: Calling getAuthData() on an AuthenticationTls instance where neither setTlsFilePath(certFile, keyFile) nor setCertStreamProvider+setKeyStreamProvider was called, or where configure() was given an empty/blank authParams map so no fields were populated.

Common situations: Building a PulsarClient with AuthenticationTls but forgetting to set the authParams JSON (tlsCertFile/tlsKeyFile); using setTlsFilePath with only one of cert or key; refactoring code that previously set paths and accidentally removing the configuration call.

Related errors

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/edb2f20b7b7f9e9d. Report an issue: GitHub.