{"record":{"id":"8420972207d99202","repo":"apache/pulsar","slug":"certstream-provider-or-stream-must-not-be-null","errorCode":null,"errorMessage":"certStream provider or stream must not be null","messagePattern":"certStream provider or stream must not be null","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationDataTls.java","lineNumber":73,"sourceCode":"        if (keyFilePath == null) {\n            throw new IllegalArgumentException(\"keyFilePath must not be null\");\n        }\n        this.certFile = new FileModifiedTimeUpdater(certFilePath);\n        this.keyFile = new FileModifiedTimeUpdater(keyFilePath);\n        this.tlsCertificates = PemReader.loadCertificatesFromPemFile(certFilePath);\n        this.tlsPrivateKey = PemReader.loadPrivateKeyFromPemFile(keyFilePath);\n    }\n\n    public AuthenticationDataTls(Supplier<ByteArrayInputStream> certStreamProvider,\n            Supplier<ByteArrayInputStream> keyStreamProvider) throws KeyManagementException {\n        this(certStreamProvider, keyStreamProvider, null);\n    }\n\n    public AuthenticationDataTls(Supplier<ByteArrayInputStream> certStreamProvider,\n            Supplier<ByteArrayInputStream> keyStreamProvider, Supplier<ByteArrayInputStream> trustStoreStreamProvider)\n            throws KeyManagementException {\n        if (certStreamProvider == null || certStreamProvider.get() == null) {\n            throw new IllegalArgumentException(\"certStream provider or stream must not be null\");\n        }\n        if (keyStreamProvider == null || keyStreamProvider.get() == null) {\n            throw new IllegalArgumentException(\"keyStream provider or stream must not be null\");\n        }\n        this.certStreamProvider = certStreamProvider;\n        this.keyStreamProvider = keyStreamProvider;\n        this.trustStoreStreamProvider = trustStoreStreamProvider;\n        this.certStream = certStreamProvider.get();\n        this.keyStream = keyStreamProvider.get();\n        this.tlsCertificates = PemReader.loadCertificatesFromPemStream(certStream);\n        this.tlsPrivateKey = PemReader.loadPrivateKeyFromPemStream(keyStream);\n    }\n    /*\n     * TLS\n     */\n\n    @Override\n    public boolean hasDataForTls() {","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationDataTls.java#L55-L91","documentation":"The stream-based AuthenticationDataTls constructor throws IllegalArgumentException when certStreamProvider is null or its Supplier<ByteArrayInputStream>.get() returns null. This variant loads the client certificate chain from a supplied stream instead of a file, so a provider that yields no stream cannot produce usable TLS auth data.","triggerScenarios":"Calling new AuthenticationDataTls(certStreamProvider, keyStreamProvider, trustStoreStreamProvider) with certStreamProvider == null, or with a supplier that returns null (e.g. lazy supplier that fails to locate a classpath resource).","commonSituations":"getResourceAsStream(...) returning null for a missing PEM resource; memoized suppliers that cache null after a failed load; refactored code passing optional suppliers that are empty; in-memory cert provisioning code that silently skips the cert.","solutions":["Ensure certStreamProvider is non-null and returns a valid ByteArrayInputStream containing the PEM certificate chain.","Check that the underlying resource/file the supplier reads actually exists and is readable.","Guard the supplier result before constructing: resolve the stream once and assert it is non-null."],"exampleFix":"// before\nSupplier<ByteArrayInputStream> cert = () -> null; // or missing resource\nnew AuthenticationDataTls(cert, key, trust);\n// after\nbyte[] pem = readClasspathResource(\"/certs/client-cert.pem\"); // throws if absent\nnew AuthenticationDataTls(() -> new ByteArrayInputStream(pem), key, trust);","handlingStrategy":"validation","validationCode":"ByteArrayInputStream cert = certStreamProvider != null ? certStreamProvider.get() : null;\nif (cert == null || cert.available() == 0) {\n    throw new IllegalStateException(\"cert stream provider must yield a non-empty PEM stream\");\n}","typeGuard":"boolean hasStream(Supplier<ByteArrayInputStream> s) { return s != null && s.get() != null; }","tryCatchPattern":"try {\n    authData = new AuthenticationDataTls(certStreamProvider, keyStreamProvider, trustStoreStreamProvider);\n} catch (IllegalArgumentException | KeyManagementException e) {\n    log.error(\"TLS stream auth misconfigured: {}\", e.getMessage());\n    throw e;\n}","preventionTips":["Resolve classpath/file resources eagerly and fail with a descriptive error when absent.","Avoid suppliers that can cache or return null after a failed load.","Test stream-based TLS wiring in CI where the PEM resources are guaranteed present."],"tags":["java","tls","authentication","streams","pulsar-client"],"backgroundTag":"missing-tls-certificate","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}