{"record":{"id":"061adcf58df10598","repo":"quarkusio/quarkus","slug":"you-must-specify-the-key-files-and-certificate-fil","errorCode":null,"errorMessage":"You must specify the key files and certificate files","messagePattern":"You must specify the key files and certificate files","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemCertsConfig.java","lineNumber":86,"sourceCode":"            }\n        }\n\n        List<Path> certDirs = certDirs().orElse(null);\n        if (certDirs != null) {\n            for (Path certDir : certDirs) {\n                try (var ds = streamDirectory(certDir)) {\n                    for (Path cert : ds) {\n                        options.addCertValue(Buffer.buffer(read(cert)));\n                    }\n                } catch (IOException e) {\n                    throw new RuntimeException(\"Failed to close directory stream opened for certificate directory \" + certDir,\n                            e);\n                }\n            }\n        }\n\n        if (options.getCertValues().isEmpty()) {\n            throw new IllegalArgumentException(\"You must specify the key files and certificate files\");\n        }\n\n        return options;\n    }\n\n    private static DirectoryStream<Path> streamDirectory(Path certificateDirectory) {\n        if (Files.notExists(certificateDirectory)) {\n            throw new ConfigurationException(\"Configured certificate path does not exist:\" + certificateDirectory);\n        }\n\n        if (!Files.isDirectory(certificateDirectory)) {\n            throw new ConfigurationException(\"Path '\" + certificateDirectory + \"' is not a directory. Paths pointing \"\n                    + \"to the certificate files can be configured with the 'quarkus.tls.trust-store.pem.certs' property\"\n                    + \" instead\");\n        }\n\n        try {\n            return Files.newDirectoryStream(certificateDirectory);","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemCertsConfig.java#L68-L104","documentation":"PemCertsConfig.toOptions() requires at least one trusted certificate; if neither pem.certs nor pem.certDirs yields any certificate values, it throws an IllegalArgumentException stating that key and certificate files must be specified. This guards against silently creating an empty trust options object that would trust nothing.","triggerScenarios":"quarkus.tls.<name>.trust-store.pem.certs is unset or empty AND all configured certDirs exist but contain no files, so PemTrustOptions ends with zero cert values.","commonSituations":"Pointing certDirs at an empty directory (e.g. a Kubernetes mounted secret volume not yet populated, or an initContainer that failed); forgetting to configure trust-store PEM material entirely while enabling mutual TLS; typo in the cert property namespace so nothing is picked up.","solutions":["Set quarkus.tls.<name>.trust-store.pem.certs to at least one CA certificate path","Or place at least one PEM file into each referenced certDirs directory","If using a mounted volume, confirm the secret/configmap actually mounted (kubectl describe pod) and files are present","Check property names/typos — e.g. trust-store vs key-store, certs vs certDirs"],"exampleFix":"// before\nquarkus.tls.trust-store.pem.certDirs=/etc/certs   # directory is empty\n// after\nquarkus.tls.trust-store.pem.certs=/etc/certs/ca.crt","handlingStrategy":"validation","validationCode":"boolean hasFiles = pemCertsConfig.certs().map(l -> !l.isEmpty()).orElse(false);\nboolean hasDirCerts = pemCertsConfig.certDirs().orElse(List.of()).stream()\n    .anyMatch(d -> { try (var s = Files.list(d)) { return s.findAny().isPresent(); } catch (IOException e) { return false; } });\nif (!hasFiles && !hasDirCerts)\n    throw new IllegalStateException(\"No trusted PEM certificates configured\");","typeGuard":null,"tryCatchPattern":"try {\n    PemTrustOptions opts = pemCertsConfig.toOptions();\n} catch (IllegalArgumentException e) {\n    // supply a default CA bundle or abort startup\n    throw new IllegalStateException(\"Trust store empty: configure trust-store.pem.certs\", e);\n}","preventionTips":["Always configure at least one trust-store.pem.certs path for mTLS setups","When using certDirs, verify mounted volumes are populated before startup (initContainer)","Assert non-empty trust material in a startup health check","Watch for typos between certs / certDirs property names"],"tags":["quarkus","tls-registry","configuration","empty-config"],"backgroundTag":"missing-tls-certificate-config","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}