{"record":{"id":"c1c7adea4149662b","repo":"quarkusio/quarkus","slug":"the-size-of-the-order-list-n-must-match-the-si","errorCode":null,"errorMessage":"The size of the `order` list (N) must match the size of the `keyCerts` map (M)","messagePattern":"The size of the `order` list \\(N\\) must match the size of the `keyCerts` map \\(M\\)","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemKeyCertConfig.java","lineNumber":47,"sourceCode":"     * The order of the key/cert files, based on the names in the `keyCerts` map.\n     * <p>\n     * By default, Quarkus sorts the key using a lexicographical order.\n     * This property allows you to specify the order of the key/cert files.\n     */\n    Optional<List<String>> order();\n\n    default PemKeyCertOptions toOptions() {\n        PemKeyCertOptions options = new PemKeyCertOptions();\n\n        if (keyCerts().isEmpty()) {\n            throw new IllegalArgumentException(\"You must specify the key files and certificate files\");\n        }\n\n        List<KeyCertConfig> orderedListOfPair = new ArrayList<>();\n        if (order().isPresent()) {\n            // Check the size of the order list. It must match the size of the keyCerts map.\n            if (order().get().size() != keyCerts().size()) {\n                throw new IllegalArgumentException(\"The size of the `order` list (\" + order().get().size() + \") must \" +\n                        \"match the size of the `keyCerts` map (\" + keyCerts().size() + \")\");\n            }\n\n            // We use the order specified by the user.\n            for (String name : order().get()) {\n                KeyCertConfig keyCert = keyCerts().get(name);\n                if (keyCert == null) {\n                    throw new IllegalArgumentException(\"The key/cert pair with the name '\" + name\n                            + \"' is not found in the `order` list: \" + order().get());\n                }\n                orderedListOfPair.add(keyCert);\n            }\n        } else {\n            // Use the lexical order.\n            orderedListOfPair.addAll(new TreeMap<>(keyCerts()).values());\n        }\n\n        for (KeyCertConfig config : orderedListOfPair) {","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemKeyCertConfig.java#L29-L65","documentation":"When the optional pem.order list is provided, PemKeyCertConfig.toOptions() requires it to name every alias in keyCerts exactly — its size must equal keyCerts.size(). A mismatched size throws IllegalArgumentException; order is a permutation list of aliases controlling SNI certificate selection, not a subset filter.","triggerScenarios":"quarkus.tls.<name>.key-store.pem.order lists fewer (or more) alias names than the number of quarkus.tls.<name>.key-store.pem.keyCerts.* entries.","commonSituations":"Adding a new keyCerts alias without updating order; removing an alias but leaving it in order (count mismatch in the other direction); configuring order from environment-specific property fragments where only some aliases are defined; hand-writing order expecting it to mean 'preferred subset'.","solutions":["Update order to list exactly all keyCerts aliases (each exactly once)","Remove the order property entirely — aliases are then used in lexical order","Reconcile environment-specific config fragments so all profiles define the same alias set"],"exampleFix":"// before (2 keyCerts, 1 order entry)\nquarkus.tls.my.key-store.pem.keyCerts.a.cert=cert-a.crt\nquarkus.tls.my.key-store.pem.keyCerts.b.cert=cert-b.crt\nquarkus.tls.my.key-store.pem.order=a\n// after\nquarkus.tls.my.key-store.pem.order=a,b","handlingStrategy":"validation","validationCode":"var pem = tlsConfig.keyStore().pem().get();\nif (pem.order().isPresent() && pem.order().get().size() != pem.keyCerts().size())\n    throw new IllegalStateException(\"pem.order size must equal keyCerts size (\"\n        + pem.order().get().size() + \" vs \" + pem.keyCerts().size() + \")\");","typeGuard":null,"tryCatchPattern":"try {\n    options = pemKeyCertConfig.toOptions();\n} catch (IllegalArgumentException e) {\n    throw new IllegalStateException(\"Reconcile pem.order with keyCerts entries\", e);\n}","preventionTips":["Treat order as a full permutation of keyCerts aliases, not a preferred subset","Update order in the same change that adds/removes keyCerts aliases","If alias set varies per environment, skip order and accept lexical ordering","Add an integration test asserting SNI alias resolution for each profile"],"tags":["quarkus","tls-registry","configuration","sni","validation"],"backgroundTag":"config-list-size-mismatch","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}