{"record":{"id":"2a72440cdccab7d4","repo":"apache/pulsar","slug":"certfilepath-must-not-be-null","errorCode":null,"errorMessage":"certFilePath must not be null","messagePattern":"certFilePath must not be null","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationDataTls.java","lineNumber":53,"sourceCode":"import org.apache.pulsar.common.util.tls.PemReader;\n\n@CustomLog\npublic class AuthenticationDataTls implements AuthenticationDataProvider {\n    private static final long serialVersionUID = 1L;\n    protected X509Certificate[] tlsCertificates;\n    protected PrivateKey tlsPrivateKey;\n    private transient FileModifiedTimeUpdater certFile, keyFile;\n    // key and cert using stream\n    private transient InputStream certStream, keyStream;\n    @SuppressFBWarnings(value = \"SE_TRANSIENT_FIELD_NOT_RESTORED\",\n            justification = \"Using custom serializer which Findbugs can't detect\")\n    private transient Supplier<ByteArrayInputStream> certStreamProvider, keyStreamProvider, trustStoreStreamProvider;\n    private static final Map<String, String> headers = Collections.singletonMap(\n            PULSAR_AUTH_METHOD_NAME, AuthenticationTls.AUTH_METHOD_NAME);\n\n    public AuthenticationDataTls(String certFilePath, String keyFilePath) throws KeyManagementException {\n        if (certFilePath == null) {\n            throw new IllegalArgumentException(\"certFilePath must not be null\");\n        }\n        if (keyFilePath == null) {\n            throw new IllegalArgumentException(\"keyFilePath must not be null\");\n        }\n        this.certFile = new FileModifiedTimeUpdater(certFilePath);\n        this.keyFile = new FileModifiedTimeUpdater(keyFilePath);\n        this.tlsCertificates = PemReader.loadCertificatesFromPemFile(certFilePath);\n        this.tlsPrivateKey = PemReader.loadPrivateKeyFromPemFile(keyFilePath);\n    }\n\n    public AuthenticationDataTls(Supplier<ByteArrayInputStream> certStreamProvider,\n            Supplier<ByteArrayInputStream> keyStreamProvider) throws KeyManagementException {\n        this(certStreamProvider, keyStreamProvider, null);\n    }\n\n    public AuthenticationDataTls(Supplier<ByteArrayInputStream> certStreamProvider,\n            Supplier<ByteArrayInputStream> keyStreamProvider, Supplier<ByteArrayInputStream> trustStoreStreamProvider)\n            throws KeyManagementException {","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationDataTls.java#L35-L71","documentation":"The AuthenticationDataTls(String certFilePath, String keyFilePath) constructor throws IllegalArgumentException when certFilePath is null. TLS authentication data wraps the client certificate chain file for mTLS; without a certificate path the auth data cannot be built, so it fails fast.","triggerScenarios":"Constructing AuthenticationDataTls with a null first argument, e.g. when AuthenticationTls is configured without the tlsCertFile parameter or the cert path variable was never assigned.","commonSituations":"authParams JSON missing the 'tlsCertFile' key; Kubernetes secret/volume mount for the cert absent so the path resolution yields null; programmatic client setup forgetting to set the certificate; environment-specific config dropping the TLS section.","solutions":["Provide a valid PEM certificate chain path (AuthenticationTls 'tlsCertFile' auth param) to the constructor.","Verify the cert secret/volume is mounted and the path variable is populated before client startup.","Fail fast in app startup: check certFilePath != null before constructing the authentication data."],"exampleFix":"// before\nnew AuthenticationDataTls(certFilePath, keyFilePath); // certFilePath is null\n// after\nObjects.requireNonNull(certFilePath, \"tlsCertFile must be configured\");\nnew AuthenticationDataTls(certFilePath, keyFilePath);","handlingStrategy":"validation","validationCode":"Objects.requireNonNull(certFilePath, \"TLS cert file path (tlsCertFile) must be configured\");\nif (!new File(certFilePath).canRead()) throw new IllegalStateException(\"cert file not readable: \" + certFilePath);","typeGuard":null,"tryCatchPattern":"try {\n    authData = new AuthenticationDataTls(certFilePath, keyFilePath);\n} catch (IllegalArgumentException | KeyManagementException e) {\n    log.error(\"TLS auth misconfigured: {}\", e.getMessage());\n    throw e;\n}","preventionTips":["Always set the 'tlsCertFile' auth parameter in AuthenticationTls.","Verify secret/volume mounts for certificates exist before client startup.","Fail fast with a clear message when the cert path is null in your own config loader."],"tags":["java","tls","authentication","configuration","pulsar-client"],"backgroundTag":"missing-tls-certificate","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}