{"record":{"id":"9ad9c0c2b7a60ebc","repo":"quarkusio/quarkus","slug":"invalid-pem-trusted-certificates-configuration-for-9ad9c0","errorCode":null,"errorMessage":"Invalid PEM trusted certificates configuration for certificate '${name}'","messagePattern":"Invalid PEM trusted certificates configuration for certificate '(.+?)'","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/PemKeyStores.java","lineNumber":57,"sourceCode":"    public static TrustStoreAndTrustOptions verifyPEMTrustStoreStore(TrustStoreConfig tsc, Vertx vertx, String name) {\n        var config = tsc.pem().orElseThrow();\n        if (config.hasNoTrustedCertificates()) {\n            throw new IllegalStateException(\"No PEM certificates configured for the trust store of '\" + name + \"'\");\n        }\n        try {\n            var options = config.toOptions();\n            KeyStore ks = options.loadKeyStore(vertx);\n            if (tsc.certificateExpirationPolicy() == TrustStoreConfig.CertificateExpiryPolicy.IGNORE) {\n                return new TrustStoreAndTrustOptions(ks, options);\n            } else {\n                var wrapped = new ExpiryTrustOptions(options, tsc.certificateExpirationPolicy());\n                return new TrustStoreAndTrustOptions(ks, wrapped);\n            }\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid PEM trusted certificates configuration for certificate '\" + name\n                    + \"' - cannot read the PEM certificate files\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid PEM trusted certificates configuration for certificate '\" + name + \"'\", e);\n        }\n    }\n}\n","sourceCodeStart":39,"sourceCodeEnd":61,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/PemKeyStores.java#L39-L61","documentation":"Generic failure while building a keystore from the configured PEM trusted certificates — any non-IO exception is wrapped in this IllegalStateException naming the certificate configuration. It is the catch-all sibling of the 'cannot read the PEM certificate files' error.","triggerScenarios":"verifyPEMTrustStoreStore catches a general Exception from config.toOptions(), options.loadKeyStore(vertx), or ExpiryTrustOptions wrapping: certificate parse failures, unsupported encodings, or expiry-policy processing errors that are not UncheckedIOException.","commonSituations":"Certificate files containing garbage/truncated PEM; intermediate certs concatenated with stray non-PEM text; expired certificates combined with a strict certificate-expiration-policy; duplicate/invalid DER blocks inside a bundle.","solutions":["Validate each certificate: openssl x509 -in cert.pem -noout -text to confirm parseability","Clean the bundle file of trailing junk, duplicate blocks, or non-PEM text between certificates","Check quarkus.tls.<name>.trust-store.certificate-expiration-policy — set to IGNORE if expired certs are intentionally kept","Re-export the certificates in base64 PEM format"],"exampleFix":"// before (bundle with expired CA + strict policy)\nquarkus.tls.my-tls.trust-store.pem.0.cert=old-bundle.pem\nquarkus.tls.my-tls.trust-store.certificate-expiration-policy=ERROR\n// after (renewed bundle)\nquarkus.tls.my-tls.trust-store.pem.0.cert=/etc/app/certs/renewed-bundle.pem","handlingStrategy":"validation","validationCode":"for (String p : certPaths) {\n    CertificateFactory cf = CertificateFactory.getInstance(\"X.509\");\n    try (InputStream in = new FileInputStream(p)) {\n        Collection<? extends Certificate> certs = cf.generateCertificates(in);\n        if (certs.isEmpty()) throw new IllegalStateException(\"No certs parsed from \" + p);\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    // use TLS config\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"Invalid PEM trusted certificates configuration\")\n            && !e.getMessage().contains(\"cannot read\")) {\n        log.errorf(e.getCause(), \"Malformed PEM trust certs for %s\", certName);\n    }\n}","preventionTips":["Pre-parse bundles with CertificateFactory.generateCertificates in a startup health check","Keep bundle files clean: no junk text between/after PEM blocks","Align certificate-expiration-policy with renewal practices (renew instead of IGNORE)","Validate certificates with openssl x509 before packaging"],"tags":["tls","pem","trust-store","certificate"],"backgroundTag":"invalid-pem-certificate","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}