{"record":{"id":"32003205042c3fa7","repo":"quarkusio/quarkus","slug":"configured-certificate-path-does-not-exist-cert","errorCode":null,"errorMessage":"Configured certificate path does not exist: + certificateDirectory","messagePattern":"Configured certificate path does not exist: \\+ certificateDirectory","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemCertsConfig.java","lineNumber":94,"sourceCode":"                        options.addCertValue(Buffer.buffer(read(cert)));\n                    }\n                } catch (IOException e) {\n                    throw new RuntimeException(\"Failed to close directory stream opened for certificate directory \" + certDir,\n                            e);\n                }\n            }\n        }\n\n        if (options.getCertValues().isEmpty()) {\n            throw new IllegalArgumentException(\"You must specify the key files and certificate files\");\n        }\n\n        return options;\n    }\n\n    private static DirectoryStream<Path> streamDirectory(Path certificateDirectory) {\n        if (Files.notExists(certificateDirectory)) {\n            throw new ConfigurationException(\"Configured certificate path does not exist:\" + certificateDirectory);\n        }\n\n        if (!Files.isDirectory(certificateDirectory)) {\n            throw new ConfigurationException(\"Path '\" + certificateDirectory + \"' is not a directory. Paths pointing \"\n                    + \"to the certificate files can be configured with the 'quarkus.tls.trust-store.pem.certs' property\"\n                    + \" instead\");\n        }\n\n        try {\n            return Files.newDirectoryStream(certificateDirectory);\n        } catch (IOException e) {\n            throw new RuntimeException(\"Failed to open DirectoryStream for configured certificate path \" + certificateDirectory,\n                    e);\n        }\n    }\n}\n","sourceCodeStart":76,"sourceCodeEnd":111,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemCertsConfig.java#L76-L111","documentation":"Before opening a directory of trusted certificates, PemCertsConfig.streamDirectory verifies the path exists; if not it throws a Quarkus ConfigurationException 'Configured certificate path does not exist:<path>'. This fails fast at configuration/build time rather than later during a TLS handshake.","triggerScenarios":"quarkus.tls.<name>.trust-store.pem.certDirs (or key-store pem certDirs) references a directory that does not exist on disk when hasNoTrustedCertificates or toOptions runs.","commonSituations":"Relative path resolved against a different working directory than expected; path only valid in dev but not in the packaged/native runtime; Kubernetes volume not mounted; typo or case-sensitivity mismatch in the path; config still set after the directory was deleted.","solutions":["Fix the configured path so it points to an existing directory, ideally absolute","Check the working directory when using relative paths (dev vs test vs prod differ)","In containers, verify the volume/secret mount creates the directory before the app starts","Create the directory if it is intentionally optional but mounted later — or drop the certDirs entry when empty"],"exampleFix":"// before\nquarkus.tls.trust-store.pem.certDirs=./certificates\n// after (absolute path)\nquarkus.tls.trust-store.pem.certDirs=/etc/quarkus/certs","handlingStrategy":"validation","validationCode":"for (Path dir : certDirs) {\n    if (Files.notExists(dir))\n        throw new IllegalStateException(\"certDir does not exist: \" + dir.toAbsolutePath());\n}\n","typeGuard":null,"tryCatchPattern":"try {\n    options = pemCertsConfig.toOptions();\n} catch (ConfigurationException e) {\n    throw new IllegalStateException(\"Fix certDirs path: \" + e.getMessage(), e);\n}","preventionTips":["Use absolute paths in configuration to avoid working-directory differences","In containers, ensure volumes/secrets are mounted before the app starts","Add a CI check that validates referenced cert paths exist per environment","Watch case sensitivity on Linux filesystems"],"tags":["quarkus","tls-registry","configuration","path-not-found"],"backgroundTag":"config-path-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}