apache/pulsar · error · IllegalArgumentException

keyStream provider or stream must not be null

Error message

keyStream provider or stream must not be null

What it means

The stream-based AuthenticationDataTls constructor throws IllegalArgumentException when keyStreamProvider is null or its Supplier<ByteArrayInputStream>.get() returns null. Like the cert check, mTLS requires the client private key; a provider yielding no stream cannot build TLS auth data.

Source

Thrown at pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationDataTls.java:76

        this.certFile = new FileModifiedTimeUpdater(certFilePath);
        this.keyFile = new FileModifiedTimeUpdater(keyFilePath);
        this.tlsCertificates = PemReader.loadCertificatesFromPemFile(certFilePath);
        this.tlsPrivateKey = PemReader.loadPrivateKeyFromPemFile(keyFilePath);
    }

    public AuthenticationDataTls(Supplier<ByteArrayInputStream> certStreamProvider,
            Supplier<ByteArrayInputStream> keyStreamProvider) throws KeyManagementException {
        this(certStreamProvider, keyStreamProvider, null);
    }

    public AuthenticationDataTls(Supplier<ByteArrayInputStream> certStreamProvider,
            Supplier<ByteArrayInputStream> keyStreamProvider, Supplier<ByteArrayInputStream> trustStoreStreamProvider)
            throws KeyManagementException {
        if (certStreamProvider == null || certStreamProvider.get() == null) {
            throw new IllegalArgumentException("certStream provider or stream must not be null");
        }
        if (keyStreamProvider == null || keyStreamProvider.get() == null) {
            throw new IllegalArgumentException("keyStream provider or stream must not be null");
        }
        this.certStreamProvider = certStreamProvider;
        this.keyStreamProvider = keyStreamProvider;
        this.trustStoreStreamProvider = trustStoreStreamProvider;
        this.certStream = certStreamProvider.get();
        this.keyStream = keyStreamProvider.get();
        this.tlsCertificates = PemReader.loadCertificatesFromPemStream(certStream);
        this.tlsPrivateKey = PemReader.loadPrivateKeyFromPemStream(keyStream);
    }
    /*
     * TLS
     */

    @Override
    public boolean hasDataForTls() {
        return true;
    }

View on GitHub (pinned to 820761864e)

Solutions

1. Ensure keyStreamProvider is non-null and returns a valid ByteArrayInputStream with the PEM private key.
2. Verify the key resource/secret exists and the supplier does not cache a null result.
3. Assert both cert and key streams resolve before constructing AuthenticationDataTls.

Example fix

// before
new AuthenticationDataTls(cert, null, trust); // key provider missing
// after
Objects.requireNonNull(key, "keyStreamProvider must be provided");
new AuthenticationDataTls(cert, key, trust);

ByteArrayInputStream key = keyStreamProvider != null ? keyStreamProvider.get() : null;
if (key == null || key.available() == 0) {
    throw new IllegalStateException("key stream provider must yield a non-empty PEM stream");
}

boolean hasStream(Supplier<ByteArrayInputStream> s) { return s != null && s.get() != null; }

try {
    authData = new AuthenticationDataTls(certStreamProvider, keyStreamProvider, trustStoreStreamProvider);
} catch (IllegalArgumentException | KeyManagementException e) {
    log.error("TLS stream auth misconfigured: {}", e.getMessage());
    throw e;
}

When it happens

Trigger: Calling the three-supplier AuthenticationDataTls constructor where keyStreamProvider is null or returns null (e.g. key resource missing on the classpath, lazily-loaded key not yet provisioned).

Common situations: Private key resource excluded from the packaged artifact; secret manager returning null when the key hasn't been rotated into place; copy-pasting the cert supplier wiring but forgetting the key supplier; optional suppliers left empty.

Related errors

• certStream provider or stream must not be null
• certFilePath must not be null
• keyFilePath must not be null
• Passed in parameter empty. KEYSTORE_PATH: ${keyStorePath} KE
• failed to get client token

AI-assisted analysis of apache/pulsar@820761864e (2026-09-06). Data as JSON: /api/errors/932df85bfb9ec06d. Report an issue: GitHub.