{"record":{"id":"19be66aaee647872","repo":"apache/pulsar","slug":"certificate-loading-error","errorCode":null,"errorMessage":"Certificate loading error","messagePattern":"Certificate loading error","errorType":"exception","errorClass":"KeyManagementException","httpStatus":null,"severity":"error","filePath":"pulsar-common/src/main/java/org/apache/pulsar/common/util/tls/PemReader.java","lineNumber":89,"sourceCode":"     * Load PEM certificates, manufacturing them with a pinned JCA provider.\n     *\n     * @param certFilePath the PEM file path\n     * @param jcaProvider  the pinned JCA provider, or {@code null} for the JVM provider search order\n     * @return the loaded certificates, or {@code null} when no path was given\n     * @throws KeyManagementException if the certificates cannot be loaded\n     */\n    public static X509Certificate[] loadCertificatesFromPemFile(String certFilePath, Provider jcaProvider)\n            throws KeyManagementException {\n        X509Certificate[] certificates = null;\n\n        if (certFilePath == null || certFilePath.isEmpty()) {\n            return certificates;\n        }\n\n        try (FileInputStream input = new FileInputStream(certFilePath)) {\n            certificates = loadCertificatesFromPemStream(input, jcaProvider);\n        } catch (GeneralSecurityException | IOException e) {\n            throw new KeyManagementException(\"Certificate loading error\", e);\n        }\n\n        return certificates;\n    }\n\n    public static X509Certificate[] loadCertificatesFromPemStream(InputStream inStream) throws KeyManagementException  {\n        return loadCertificatesFromPemStream(inStream, null);\n    }\n\n    /**\n     * Load PEM certificates from a stream, manufacturing them with a pinned JCA provider.\n     *\n     * @param inStream    the PEM stream\n     * @param jcaProvider the pinned JCA provider, or {@code null} for the JVM provider search order\n     * @return the loaded certificates, or {@code null} when no stream was given\n     * @throws KeyManagementException if the certificates cannot be loaded\n     */\n    public static X509Certificate[] loadCertificatesFromPemStream(InputStream inStream, Provider jcaProvider)","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-common/src/main/java/org/apache/pulsar/common/util/tls/PemReader.java#L71-L107","documentation":"PemReader.loadCertificatesFromPemFile wraps any GeneralSecurityException or IOException raised while reading and parsing the PEM certificate file into a KeyManagementException with message 'Certificate loading error'. It signals that the certificate file could not be read or its PEM blocks could not be parsed as X.509 certificates.","triggerScenarios":"Certificate file path does not exist / not readable (FileNotFoundException, wrapped IOException); invalid or corrupted PEM content; unsupported provider combination that fails during certificateFactory(...) (CertificateException); truncation or permission errors while reading the stream.","commonSituations":"Wrong tlsCertificateFilePath configured on broker/client; file missing after deployment or volume not mounted; PEM containing only a private key or encrypted PKCS#8 blocks the parser cannot handle; FIPS provider lacking X.509 CertificateFactory.","solutions":["Verify the certificate file path exists and is readable by the process (ls -l, permissions, mount)","Ensure the file contains valid PEM CERTIFICATE blocks (BEGIN/END lines, base64 intact, correct chain order)","Check the cause in the stack trace to distinguish I/O problems from parse/provider problems","Re-export the certificate in PEM (X.509) format, e.g. openssl x509 -in cert.der -out cert.pem"],"exampleFix":"// before\ntlsCertificateFilePath=/secrets/broker.crt   // file not mounted\n// after\n// ensure the PEM file is present, e.g.:\n// openssl x509 -in cert.der -out /secrets/broker.pem\n// then in code, guard:\nFile f = new File(path);\nif (!f.canRead()) throw new IllegalStateException(\"cert file missing: \" + path);","handlingStrategy":"try-catch","validationCode":"File f = new File(certPath);\nif (!f.isFile() || !f.canRead()) throw new IllegalStateException(\"Unreadable cert file: \" + certPath);\ntry (BufferedReader r = new BufferedReader(new FileReader(f))) { if (!\"-----BEGIN CERTIFICATE-----\".equals(r.readLine().trim())) throw new IllegalStateException(\"Not a PEM cert file\"); }","typeGuard":null,"tryCatchPattern":"try { return PemReader.loadCertificatesFromPemFile(path); } catch (KeyManagementException e) { log.error(\"Failed loading certificates from {}: {}\", path, e.getCause()); throw new IllegalStateException(\"Invalid certificate configuration\", e); }","preventionTips":["Validate file existence/readability before wiring the TLS config","Ensure the file contains proper BEGIN/END CERTIFICATE PEM blocks","Log e.getCause() to distinguish I/O vs parse vs provider errors","Convert DER/binary certs to PEM before use","Mount secrets and verify permissions in containerized deployments"],"tags":["java","tls","pem","certificates","io"],"backgroundTag":"certificate-loading-error","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}