{"record":{"id":"6fb7b3d233129481","repo":"quarkusio/quarkus","slug":"you-must-specify-the-key-files-and-certificate-fil-6fb7b3","errorCode":null,"errorMessage":"You must specify the key files and certificate files","messagePattern":"You must specify the key files and certificate files","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemKeyCertConfig.java","lineNumber":40,"sourceCode":"    /**\n     * List of the PEM key/cert files (Pem format).\n     */\n    @WithParentName\n    Map<String, KeyCertConfig> keyCerts();\n\n    /**\n     * The order of the key/cert files, based on the names in the `keyCerts` map.\n     * <p>\n     * By default, Quarkus sorts the key using a lexicographical order.\n     * This property allows you to specify the order of the key/cert files.\n     */\n    Optional<List<String>> order();\n\n    default PemKeyCertOptions toOptions() {\n        PemKeyCertOptions options = new PemKeyCertOptions();\n\n        if (keyCerts().isEmpty()) {\n            throw new IllegalArgumentException(\"You must specify the key files and certificate files\");\n        }\n\n        List<KeyCertConfig> orderedListOfPair = new ArrayList<>();\n        if (order().isPresent()) {\n            // Check the size of the order list. It must match the size of the keyCerts map.\n            if (order().get().size() != keyCerts().size()) {\n                throw new IllegalArgumentException(\"The size of the `order` list (\" + order().get().size() + \") must \" +\n                        \"match the size of the `keyCerts` map (\" + keyCerts().size() + \")\");\n            }\n\n            // We use the order specified by the user.\n            for (String name : order().get()) {\n                KeyCertConfig keyCert = keyCerts().get(name);\n                if (keyCert == null) {\n                    throw new IllegalArgumentException(\"The key/cert pair with the name '\" + name\n                            + \"' is not found in the `order` list: \" + order().get());\n                }\n                orderedListOfPair.add(keyCert);","sourceCodeStart":22,"sourceCodeEnd":58,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemKeyCertConfig.java#L22-L58","documentation":"PemKeyCertConfig.toOptions() builds Vert.x PemKeyCertOptions from the configured keyCerts map; if keyCerts is empty there is no key/cert material at all, so it throws an IllegalArgumentException requiring key files and certificate files to be specified. A keystore cannot be constructed without any key pair.","triggerScenarios":"quarkus.tls.<name>.key-store.pem.keyCerts is empty/absent while the pem group itself is present (e.g. only pem.sni or other keys set), so toOptions() has nothing to load — e.g. via quarkus.tls.<name>.key-store.pem enabled with no keyCerts entries.","commonSituations":"Defining quarkus.tls.<name>.key-store.pem without any .keyCerts.<alias>.key/.cert entries; generating config properties programmatically where the map was never populated; renaming the alias namespace so the old entries no longer match; enabling TLS but expecting credentials from elsewhere (provider is a separate mechanism).","solutions":["Add at least one entry: quarkus.tls.<name>.key-store.pem.keyCerts.<alias>.cert=<cert path> and .key=<key path>","If you intended a keystore provider instead, remove the pem block and register the KeyStoreProvider bean","Verify the property keys are correct (keyCerts.<alias>.key / .cert) and not filtered out by a profile or build-time condition"],"exampleFix":"// before\nquarkus.tls.my.key-store.pem.sni=true   # no keyCerts entries\n// after\nquarkus.tls.my.key-store.pem.keyCerts.default.key=/etc/certs/server-key.pem\nquarkus.tls.my.key-store.pem.keyCerts.default.cert=/etc/certs/server-cert.pem\nquarkus.tls.my.key-store.pem.sni=true","handlingStrategy":"validation","validationCode":"var pem = tlsConfig.keyStore().pem();\nif (pem.isPresent() && pem.get().keyCerts().isEmpty())\n    throw new IllegalStateException(\"key-store.pem enabled but no keyCerts entries configured\");","typeGuard":null,"tryCatchPattern":"try {\n    options = pemKeyCertConfig.toOptions();\n} catch (IllegalArgumentException e) {\n    throw new IllegalStateException(\"Add keyCerts.<alias>.key/.cert properties\", e);\n}","preventionTips":["Every key-store.pem block must define at least one keyCerts.<alias> with key and cert","If credentials come from a KeyStoreProvider, remove the pem block instead","Generate both .key and .cert properties together to avoid partial config","Validate effective config in CI before deployment"],"tags":["quarkus","tls-registry","configuration","empty-config"],"backgroundTag":"missing-tls-certificate-config","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}