{"record":{"id":"53abba2e6bd43f61","repo":"quarkusio/quarkus","slug":"invalid-key-certificate-pair-configuration-for-cer-53abba","errorCode":null,"errorMessage":"Invalid key/certificate pair configuration for certificate '${name}'","messagePattern":"Invalid key/certificate pair configuration for certificate '(.+?)'","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/PemKeyStores.java","lineNumber":35,"sourceCode":"public class PemKeyStores {\n\n    private PemKeyStores() {\n        // Avoid direct instantiation\n    }\n\n    public static KeyStoreAndKeyCertOptions verifyPEMKeyStore(KeyStoreConfig ksc, Vertx vertx, String name) {\n        PemKeyCertConfig config = ksc.pem().orElseThrow();\n        if (config.keyCerts().isEmpty()) {\n            throw new IllegalStateException(\"No key/certificate pair configured for certificate '\" + name + \"'\");\n        }\n        try {\n            PemKeyCertOptions options = config.toOptions();\n            return new KeyStoreAndKeyCertOptions(options.loadKeyStore(vertx), options);\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid key/certificate pair configuration for certificate '\" + name\n                    + \"' - cannot read the key/certificate files\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid key/certificate pair configuration for certificate '\" + name + \"'\", e);\n        }\n    }\n\n    public static TrustStoreAndTrustOptions verifyPEMTrustStoreStore(TrustStoreConfig tsc, Vertx vertx, String name) {\n        var config = tsc.pem().orElseThrow();\n        if (config.hasNoTrustedCertificates()) {\n            throw new IllegalStateException(\"No PEM certificates configured for the trust store of '\" + name + \"'\");\n        }\n        try {\n            var options = config.toOptions();\n            KeyStore ks = options.loadKeyStore(vertx);\n            if (tsc.certificateExpirationPolicy() == TrustStoreConfig.CertificateExpiryPolicy.IGNORE) {\n                return new TrustStoreAndTrustOptions(ks, options);\n            } else {\n                var wrapped = new ExpiryTrustOptions(options, tsc.certificateExpirationPolicy());\n                return new TrustStoreAndTrustOptions(ks, wrapped);\n            }\n        } catch (UncheckedIOException e) {","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/PemKeyStores.java#L17-L53","documentation":"Generic failure while turning a configured PEM key/certificate pair into a usable keystore — any non-IO exception from option building or loading is wrapped in this IllegalStateException naming the certificate configuration. It is the catch-all sibling of the more specific 'cannot read the files' error.","triggerScenarios":"verifyPEMKeyStore catches a general Exception from config.toOptions() or options.loadKeyStore(vertx): malformed key material, key/cert mismatch, unsupported key algorithm, or parsing errors that are not UncheckedIOException.","commonSituations":"Private key and certificate do not form a pair (mismatched files); key is in unsupported format (e.g. 'BEGIN RSA PRIVATE KEY' variants the parser rejects); files swapped (key where cert expected); PKCS#8 vs PKCS#1 key encoding issues.","solutions":["Confirm the key and cert are a matching pair: compare modulus with openssl x509 -modulus and openssl rsa -modulus","Convert the key to PKCS#8 unencrypted: openssl pkcs8 -topk8 -nocrypt -in key.pem -out key.pk8.pem","Make sure the .key property points to the private key and .cert to the certificate, not swapped","Regenerate the pair if mismatched and reconfigure the paths"],"exampleFix":"// before (mismatched pair)\nquarkus.tls.my-tls.key-store.pem.0.key=old-key.pem\nquarkus.tls.my-tls.key-store.pem.0.cert=new-cert.pem\n// after (matching pair)\nquarkus.tls.my-tls.key-store.pem.0.key=new-key.pk8.pem\nquarkus.tls.my-tls.key-store.pem.0.cert=new-cert.pem","handlingStrategy":"validation","validationCode":"// check key/cert pair matches before configuring\nPublicKey pub = loadCert(certPath).getPublicKey();\nPrivateKey priv = loadKey(keyPath);\nSignature sig = Signature.getInstance(\"SHA256withRSA\");\nsig.initSign(priv); sig.update(\"t\".getBytes());\nsig.initVerify(pub); sig.update(\"t\".getBytes());\nif (!sig.verify(sig.sign())) throw new IllegalStateException(\"key/cert mismatch\");","typeGuard":null,"tryCatchPattern":"try {\n    // use TLS config\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"Invalid key/certificate pair configuration\")\n            && !e.getMessage().contains(\"cannot read\")) {\n        log.errorf(e.getCause(), \"Key material invalid for %s (mismatch/format?)\", certName);\n    }\n}","preventionTips":["Generate key+cert together and keep them versioned as a pair","Convert legacy keys to PKCS#8: openssl pkcs8 -topk8 -nocrypt","Double-check .key gets the private key and .cert gets the certificate","Validate both files with openssl before deployment"],"tags":["tls","pem","certificate","key-mismatch"],"backgroundTag":"pem-key-cert-invalid","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}