{"record":{"id":"9ebc04bf4d0b202e","repo":"eclipse-vertx/vert.x","slug":"missing-begin-certificate-delimiter","errorCode":null,"errorMessage":"Missing -----BEGIN CERTIFICATE----- delimiter","messagePattern":"Missing -----BEGIN CERTIFICATE----- delimiter","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/net/impl/KeyStoreHelper.java","lineNumber":399,"sourceCode":"  private static X509Certificate[] loadCerts(Buffer buffer) throws Exception {\n    if (buffer == null) {\n      throw new RuntimeException(\"Missing X.509 certificate path\");\n    }\n    CertificateFactory certFactory = CertificateFactory.getInstance(\"X.509\");\n    List<X509Certificate> certs = loadPems(buffer, (delimiter, content) -> {\n      try {\n        switch (delimiter) {\n          case \"CERTIFICATE\":\n            return (Collection<X509Certificate>) certFactory.generateCertificates(new ByteArrayInputStream(content));\n          default:\n            return Collections.emptyList();\n        }\n      } catch (CertificateException e) {\n        throw new VertxException(e);\n      }\n    });\n    if (certs.isEmpty()) {\n      throw new RuntimeException(\"Missing -----BEGIN CERTIFICATE----- delimiter\");\n    }\n    return certs.toArray(new X509Certificate[0]);\n  }\n\n  /**\n   * Creates an empty keystore. The keystore uses the default keystore type set in\n   * the file 'lib/security/security.java' (located in the JRE) by the 'keystore.type' property.\n   * However, if the default is set to the 'JKS' format, the this function will instead attempt to\n   * use the newer 'PKCS12' format, if it exists.\n   *\n   * The PKCS12 format is the default format for keystores for Java >=9 and available on GraalVM.\n   *\n   * PKCS12 is an extensible, standard, and widely-supported format for storing cryptographic keys.\n   * As of JDK 8, PKCS12 keystores can store private keys, trusted public key certificates, and\n   * secret keys.\n   *\n   * The \"old\" default \"JKS\" (available since Java 1.2) can only store private keys and trusted\n   * public-key certificates, and they are based on a proprietary format that is not easily","sourceCodeStart":381,"sourceCodeEnd":417,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/net/impl/KeyStoreHelper.java#L381-L417","documentation":"loadCerts() throws 'Missing -----BEGIN CERTIFICATE----- delimiter' when the buffer contains no CERTIFICATE PEM block at all (or only unrecognized block types). The certificate option was given content that is not a PEM certificate chain.","triggerScenarios":"setCertPath/setCertValue pointing at a key file, a PKCS12 binary, or a file with only non-certificate blocks; empty trust config file.","commonSituations":"Swapping cert and key paths in configuration; mounting the wrong secret key; trusting a binary .pfx where PEM expected.","solutions":["Verify the file starts with -----BEGIN CERTIFICATE----- (head -1 cert.pem).","Swap cert/key options if they were reversed.","Export PEM certificates from the binary store: openssl pkcs12 -in store.pfx -clcerts -nokeys -out cert.pem.","Ensure the mounted secret/configmap actually contains the certificate."],"exampleFix":"// before\noptions.setCertPath(\"server.key\"); // wrong file\n// after\noptions.setCertPath(\"server.crt\"); // -----BEGIN CERTIFICATE-----","handlingStrategy":"validation","validationCode":"String head = Files.readString(Path.of(certPath)).stripLeading();\nif (!head.startsWith(\"-----BEGIN CERTIFICATE-----\"))\n    throw new IllegalStateException(certPath + \" is not a PEM certificate chain\");","typeGuard":"boolean isPemCertificate(String s) {\n  return s != null && s.contains(\"-----BEGIN CERTIFICATE-----\");\n}","tryCatchPattern":null,"preventionTips":["Keep key and cert files named/served distinctly (server.key vs server.crt)","Verify mounted secret keys map to the right files","Export PEM from keystores before use; Vert.x PEM options need text blocks","Validate cert file headers in deployment smoke tests"],"tags":["ssl","pem","certificate"],"backgroundTag":"invalid-pem-file","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}