{"record":{"id":"2d3e566ed0b7396c","repo":"quarkusio/quarkus","slug":"no-key-certificate-pair-configured-for-certificate","errorCode":null,"errorMessage":"No key/certificate pair configured for certificate '${name}'","messagePattern":"No key/certificate pair configured for certificate '(.+?)'","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/PemKeyStores.java","lineNumber":26,"sourceCode":"import io.quarkus.tls.runtime.config.KeyStoreConfig;\nimport io.quarkus.tls.runtime.config.PemKeyCertConfig;\nimport io.quarkus.tls.runtime.config.TrustStoreConfig;\nimport io.vertx.core.Vertx;\nimport io.vertx.core.net.PemKeyCertOptions;\n\n/**\n * A utility class to validate PEM key store and trust store configurations.\n */\npublic class PemKeyStores {\n\n    private PemKeyStores() {\n        // Avoid direct instantiation\n    }\n\n    public static KeyStoreAndKeyCertOptions verifyPEMKeyStore(KeyStoreConfig ksc, Vertx vertx, String name) {\n        PemKeyCertConfig config = ksc.pem().orElseThrow();\n        if (config.keyCerts().isEmpty()) {\n            throw new IllegalStateException(\"No key/certificate pair configured for certificate '\" + name + \"'\");\n        }\n        try {\n            PemKeyCertOptions options = config.toOptions();\n            return new KeyStoreAndKeyCertOptions(options.loadKeyStore(vertx), options);\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid key/certificate pair configuration for certificate '\" + name\n                    + \"' - cannot read the key/certificate files\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid key/certificate pair configuration for certificate '\" + name + \"'\", e);\n        }\n    }\n\n    public static TrustStoreAndTrustOptions verifyPEMTrustStoreStore(TrustStoreConfig tsc, Vertx vertx, String name) {\n        var config = tsc.pem().orElseThrow();\n        if (config.hasNoTrustedCertificates()) {\n            throw new IllegalStateException(\"No PEM certificates configured for the trust store of '\" + name + \"'\");\n        }\n        try {","sourceCodeStart":8,"sourceCodeEnd":44,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/PemKeyStores.java#L8-L44","documentation":"Quarkus TLS registry verifies PEM certificate configurations before use; if the pem section is present but contains no key/certificate file pairs, verification fails immediately. PEM configs must list at least one (key, cert) pair to build a usable keystore.","triggerScenarios":"Calling verifyPEMKeyStore with a KeyStoreConfig whose PemKeyCertConfig.keyCerts() is empty — e.g. quarkus.tls.<name>.key-store.pem defined but no pem.<n>.key / pem.<n>.cert entries set.","commonSituations":"User enables PEM key store config but forgets to add the key/cert file properties; all pairs were removed during config cleanup while the pem section remained; property names mis-typed so entries do not register.","solutions":["Add at least one key/cert pair: quarkus.tls.<name>.key-store.pem.0.key=... and quarkus.tls.<name>.key-store.pem.0.cert=...","Check file paths are absolute or resolvable and point to unencrypted PEM files","If PEM is not needed, remove the whole quarkus.tls.<name>.key-store.pem section instead of leaving it empty"],"exampleFix":"// before\nquarkus.tls.my-tls.key-store.pem.enabled=true\n// no pairs defined\n// after\nquarkus.tls.my-tls.key-store.pem.0.key=conf/server-key.pem\nquarkus.tls.my-tls.key-store.pem.0.cert=conf/server-cert.pem","handlingStrategy":"validation","validationCode":"// fail fast at startup if PEM pairs are not configured\nif (ConfigProvider.getConfig()\n        .getPropertyNames().stream()\n        .noneMatch(p -> p.startsWith(\"quarkus.tls.my-tls.key-store.pem.\"))) {\n    throw new IllegalStateException(\"No PEM key/cert pairs configured for my-tls\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    TlsConfiguration.from(registry, Optional.of(\"my-tls\"));\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"No key/certificate pair configured\")) {\n        log.error(\"Add quarkus.tls.my-tls.key-store.pem.<n>.key/.cert properties\");\n    }\n}","preventionTips":["Always set both pem.<n>.key and pem.<n>.cert when enabling the pem section","Never leave a pem section enabled with zero entries; remove it entirely if unused","Document required PEM properties for your deployment profile"],"tags":["tls","pem","certificate","configuration"],"backgroundTag":"empty-pem-key-cert-config","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}