{"record":{"id":"9d25897ea40b38ff","repo":"quarkusio/quarkus","slug":"no-pem-certificates-configured-for-the-trust-store","errorCode":null,"errorMessage":"No PEM certificates configured for the trust store of '${name}'","messagePattern":"No PEM certificates configured for the trust store of '(.+?)'","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/PemKeyStores.java","lineNumber":42,"sourceCode":"        PemKeyCertConfig config = ksc.pem().orElseThrow();\n        if (config.keyCerts().isEmpty()) {\n            throw new IllegalStateException(\"No key/certificate pair configured for certificate '\" + name + \"'\");\n        }\n        try {\n            PemKeyCertOptions options = config.toOptions();\n            return new KeyStoreAndKeyCertOptions(options.loadKeyStore(vertx), options);\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid key/certificate pair configuration for certificate '\" + name\n                    + \"' - cannot read the key/certificate files\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid key/certificate pair configuration for certificate '\" + name + \"'\", e);\n        }\n    }\n\n    public static TrustStoreAndTrustOptions verifyPEMTrustStoreStore(TrustStoreConfig tsc, Vertx vertx, String name) {\n        var config = tsc.pem().orElseThrow();\n        if (config.hasNoTrustedCertificates()) {\n            throw new IllegalStateException(\"No PEM certificates configured for the trust store of '\" + name + \"'\");\n        }\n        try {\n            var options = config.toOptions();\n            KeyStore ks = options.loadKeyStore(vertx);\n            if (tsc.certificateExpirationPolicy() == TrustStoreConfig.CertificateExpiryPolicy.IGNORE) {\n                return new TrustStoreAndTrustOptions(ks, options);\n            } else {\n                var wrapped = new ExpiryTrustOptions(options, tsc.certificateExpirationPolicy());\n                return new TrustStoreAndTrustOptions(ks, wrapped);\n            }\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid PEM trusted certificates configuration for certificate '\" + name\n                    + \"' - cannot read the PEM certificate files\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid PEM trusted certificates configuration for certificate '\" + name + \"'\", e);\n        }\n    }\n}","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/PemKeyStores.java#L24-L60","documentation":"Quarkus TLS registry verifies PEM trust stores before use; if the pem trust store section is present but no trusted certificate files are configured, verification fails. A trust store with zero trusted certificates is meaningless, so the registry rejects it up front.","triggerScenarios":"Calling verifyPEMTrustStoreStore where the PemTrustCertConfig hasNoTrustedCertificates() returns true — e.g. quarkus.tls.<name>.trust-store.pem defined but no pem.<n>.cert properties set.","commonSituations":"Trust store enabled but certificate list left empty; all cert entries removed in config refactoring; property prefix typo so entries are not picked up; copying a key-store-style config (with key/cert pairs) instead of the trust-store format.","solutions":["Add at least one trusted certificate: quarkus.tls.<name>.trust-store.pem.0.cert=ca-cert.pem","Check the trust-store.pem.* property names and indexes are correct (cert entries, not key entries)","Remove the empty pem section if PEM trust store is not actually needed"],"exampleFix":"// before\nquarkus.tls.my-tls.trust-store.pem.enabled=true\n// after\nquarkus.tls.my-tls.trust-store.pem.0.cert=/etc/app/certs/ca.pem","handlingStrategy":"validation","validationCode":"if (ConfigProvider.getConfig()\n        .getPropertyNames().stream()\n        .noneMatch(p -> p.startsWith(\"quarkus.tls.my-tls.trust-store.pem.\"))) {\n    throw new IllegalStateException(\"No PEM trusted certificates configured for my-tls\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    TlsConfiguration.from(registry, Optional.of(\"my-tls\"));\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"No PEM certificates configured for the trust store\")) {\n        log.error(\"Add quarkus.tls.my-tls.trust-store.pem.<n>.cert properties\");\n    }\n}","preventionTips":["Always add at least one pem.<n>.cert entry when enabling the PEM trust store","Use trust-store.pem.* (cert only), not key-store-style key/cert pairs","Remove the pem trust store section entirely if it is not used"],"tags":["tls","pem","trust-store","configuration"],"backgroundTag":"empty-pem-trust-store","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}