{"record":{"id":"108a108234e85574","repo":"eclipse-vertx/vert.x","slug":"empty-pem-file","errorCode":null,"errorMessage":"Empty pem file","messagePattern":"Empty pem file","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/net/impl/KeyStoreHelper.java","lineNumber":371,"sourceCode":"    Matcher endMatcher = END_PATTERN.matcher(pem);\n    while (true) {\n      boolean begin = beginMatcher.find();\n      if (!begin) {\n        break;\n      }\n      String beginDelimiter = beginMatcher.group(1);\n      boolean end = endMatcher.find();\n      if (!end) {\n        throw new RuntimeException(\"Missing -----END \" + beginDelimiter + \"----- delimiter\");\n      } else {\n        String endDelimiter = endMatcher.group(1);\n        if (!beginDelimiter.equals(endDelimiter)) {\n          throw new RuntimeException(\"Missing -----END \" + beginDelimiter + \"----- delimiter\");\n        } else {\n          String content = pem.substring(beginMatcher.end(), endMatcher.start());\n          content = content.replaceAll(\"\\\\s\", \"\");\n          if (content.length() == 0) {\n            throw new RuntimeException(\"Empty pem file\");\n          }\n          Collection<P> pemItems = pemFact.apply(endDelimiter, Base64.getDecoder().decode(content));\n          pems.addAll(pemItems);\n        }\n      }\n    }\n    return pems;\n  }\n\n  private static X509Certificate[] loadCerts(Buffer buffer) throws Exception {\n    if (buffer == null) {\n      throw new RuntimeException(\"Missing X.509 certificate path\");\n    }\n    CertificateFactory certFactory = CertificateFactory.getInstance(\"X.509\");\n    List<X509Certificate> certs = loadPems(buffer, (delimiter, content) -> {\n      try {\n        switch (delimiter) {\n          case \"CERTIFICATE\":","sourceCodeStart":353,"sourceCodeEnd":389,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/net/impl/KeyStoreHelper.java#L353-L389","documentation":"After matching a BEGIN/END pair, loadPems() strips whitespace from the base64 body and throws 'Empty pem file' if nothing remains. This means the PEM delimiters enclose no data — an empty or whitespace-only block.","triggerScenarios":"A PEM file containing only delimiter lines (secret created from empty value), a template variable that interpolated to nothing between BEGIN/END, or a file where all body lines were lost.","commonSituations":"Kubernetes secrets rendered with an unset env var; copy-paste that skipped the base64 body; backup tooling that stored headers only.","solutions":["Inspect the file between the BEGIN/END lines — it must contain base64 lines; restore the actual key/cert material.","Re-export the certificate/key from its source (openssl, keystore, cert manager).","Fix the templating/secret value that produced an empty body.","Validate before use: openssl x509 -in file -noout fails on empty bodies."],"exampleFix":"// before (empty body)\n-----BEGIN CERTIFICATE-----\n-----END CERTIFICATE-----\n// after\n-----BEGIN CERTIFICATE-----\nMIIDdTCCAl2gAwIBAgI...\n-----END CERTIFICATE-----","handlingStrategy":"validation","validationCode":"String body = pem.replaceAll(\"(?s).*?-----BEGIN [^-]+-----\", \"\").replaceAll(\"-----END.*\", \"\").replaceAll(\"\\\\s\", \"\");\nif (body.isEmpty()) throw new IllegalStateException(\"PEM block has empty body: \" + pemPath);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check secret values are non-empty when creating configmaps/secrets","Fail fast on empty TLS files at application startup","Use templates with strict variable interpolation so unset vars error out","Validate with openssl x509 before deployment"],"tags":["ssl","pem","empty-file"],"backgroundTag":"invalid-pem-file","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}