{"record":{"id":"b73c23d522be8316","repo":"quarkusio/quarkus","slug":"the-key-cert-pair-with-the-name-name-is","errorCode":null,"errorMessage":"The key/cert pair with the name '\" + name + \"' is not found in the `order` list: + order().get()","messagePattern":"The key/cert pair with the name '\" \\+ name \\+ \"' is not found in the `order` list: \\+ order\\(\\)\\.get\\(\\)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemKeyCertConfig.java","lineNumber":55,"sourceCode":"        PemKeyCertOptions options = new PemKeyCertOptions();\n\n        if (keyCerts().isEmpty()) {\n            throw new IllegalArgumentException(\"You must specify the key files and certificate files\");\n        }\n\n        List<KeyCertConfig> orderedListOfPair = new ArrayList<>();\n        if (order().isPresent()) {\n            // Check the size of the order list. It must match the size of the keyCerts map.\n            if (order().get().size() != keyCerts().size()) {\n                throw new IllegalArgumentException(\"The size of the `order` list (\" + order().get().size() + \") must \" +\n                        \"match the size of the `keyCerts` map (\" + keyCerts().size() + \")\");\n            }\n\n            // We use the order specified by the user.\n            for (String name : order().get()) {\n                KeyCertConfig keyCert = keyCerts().get(name);\n                if (keyCert == null) {\n                    throw new IllegalArgumentException(\"The key/cert pair with the name '\" + name\n                            + \"' is not found in the `order` list: \" + order().get());\n                }\n                orderedListOfPair.add(keyCert);\n            }\n        } else {\n            // Use the lexical order.\n            orderedListOfPair.addAll(new TreeMap<>(keyCerts()).values());\n        }\n\n        for (KeyCertConfig config : orderedListOfPair) {\n            options.addCertValue(Buffer.buffer(read(config.cert())));\n            if (config.password().isPresent()) {\n                byte[] content = read(config.key());\n                String contentAsString = new String(content, StandardCharsets.UTF_8);\n                Buffer decrypted = new EncryptedPKCS8Parser().decryptKey(contentAsString, config.password().get());\n                if (decrypted == null) {\n                    throw new IllegalArgumentException(\"Unable to decrypt the key file: \" + config.key());\n                }","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemKeyCertConfig.java#L37-L73","documentation":"Each name in pem.order must match a keyCerts map key; PemKeyCertConfig.toOptions() throws IllegalArgumentException when an ordered name has no corresponding keyCerts entry, since ordering cannot reference a nonexistent key/cert pair. Note the message text says 'not found in the `order` list' but the real mismatch is with the keyCerts map.","triggerScenarios":"quarkus.tls.<name>.key-store.pem.order contains an alias string that is not a key under quarkus.tls.<name>.key-store.pem.keyCerts (typo, renamed alias, stale entry, or quoting/indexing difference in the property name).","commonSituations":"Typos in the order list (e.g. 'prod ' with trailing space, wrong case); renaming keyCerts.<alias> entries without updating order; environment variables overriding only some keyCerts keys so the order entry no longer resolves; copy-pasting order values between keystore names.","solutions":["Align every order entry with an existing keyCerts alias name (fix typos/case)","Remove stale names from order, or add the missing keyCerts.<alias> entries","Temporarily delete order to let lexical ordering work while you fix the names","Log/inspect resolved SmallRye Config properties to see the actual keyCerts keys at runtime"],"exampleFix":"// before\nquarkus.tls.my.key-store.pem.keyCerts.server.cert=cert.crt\nquarkus.tls.my.key-store.pem.order=servr   # typo\n// after\nquarkus.tls.my.key-store.pem.order=server","handlingStrategy":"validation","validationCode":"var pem = tlsConfig.keyStore().pem().get();\nif (pem.order().isPresent())\n    for (String name : pem.order().get())\n        if (!pem.keyCerts().containsKey(name))\n            throw new IllegalStateException(\"pem.order references unknown alias: \" + name);","typeGuard":null,"tryCatchPattern":"try {\n    options = pemKeyCertConfig.toOptions();\n} catch (IllegalArgumentException e) {\n    // message names the offending alias; log keyCerts keys for comparison\n    throw new IllegalStateException(\"Order alias mismatch with keyCerts keys\", e);\n}","preventionTips":["Copy alias names exactly (case, spelling, no trailing spaces) between keyCerts and order","Rename keyCerts aliases and order entries in the same commit","When in doubt, remove order temporarily — lexical order is the safe default","Trim/normalize alias names when sourced from environment variables"],"tags":["quarkus","tls-registry","configuration","sni","validation"],"backgroundTag":"config-reference-missing-key","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}