{"record":{"id":"dcba83ef5f7a9ab3","repo":"quarkusio/quarkus","slug":"invalid-key-certificate-pair-configuration-for-cer","errorCode":null,"errorMessage":"Invalid key/certificate pair configuration for certificate '${name}' - cannot read the key/certificate files","messagePattern":"Invalid key/certificate pair configuration for certificate '(.+?)' - cannot read the key/certificate files","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/PemKeyStores.java","lineNumber":32,"sourceCode":"/**\n * A utility class to validate PEM key store and trust store configurations.\n */\npublic class PemKeyStores {\n\n    private PemKeyStores() {\n        // Avoid direct instantiation\n    }\n\n    public static KeyStoreAndKeyCertOptions verifyPEMKeyStore(KeyStoreConfig ksc, Vertx vertx, String name) {\n        PemKeyCertConfig config = ksc.pem().orElseThrow();\n        if (config.keyCerts().isEmpty()) {\n            throw new IllegalStateException(\"No key/certificate pair configured for certificate '\" + name + \"'\");\n        }\n        try {\n            PemKeyCertOptions options = config.toOptions();\n            return new KeyStoreAndKeyCertOptions(options.loadKeyStore(vertx), options);\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid key/certificate pair configuration for certificate '\" + name\n                    + \"' - cannot read the key/certificate files\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid key/certificate pair configuration for certificate '\" + name + \"'\", e);\n        }\n    }\n\n    public static TrustStoreAndTrustOptions verifyPEMTrustStoreStore(TrustStoreConfig tsc, Vertx vertx, String name) {\n        var config = tsc.pem().orElseThrow();\n        if (config.hasNoTrustedCertificates()) {\n            throw new IllegalStateException(\"No PEM certificates configured for the trust store of '\" + name + \"'\");\n        }\n        try {\n            var options = config.toOptions();\n            KeyStore ks = options.loadKeyStore(vertx);\n            if (tsc.certificateExpirationPolicy() == TrustStoreConfig.CertificateExpiryPolicy.IGNORE) {\n                return new TrustStoreAndTrustOptions(ks, options);\n            } else {\n                var wrapped = new ExpiryTrustOptions(options, tsc.certificateExpirationPolicy());","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/PemKeyStores.java#L14-L50","documentation":"Thrown when the PEM key/certificate files configured for a named TLS certificate configuration cannot be read from disk — the load raised UncheckedIOException. The configuration is structurally valid, but the files themselves are inaccessible or unreadable.","triggerScenarios":"verifyPEMKeyStore calls PemKeyCertOptions.loadKeyStore(vertx) and an UncheckedIOException occurs: file missing, wrong path, no read permission, or content is not valid PEM while reading.","commonSituations":"Key/cert files absent in container image (paths valid locally but not in container); permissions changed by deployment tooling; key is encrypted PEM requiring a password not supported here; relative paths broken after working-directory change.","solutions":["Verify both key and cert files exist and are readable at the configured paths (ls -l / cat test)","Use absolute paths in quarkus.tls.<name>.key-store.pem.<n>.key/.cert so runtime cwd does not matter","Check the PEM content is valid unencrypted PEM (-----BEGIN PRIVATE KEY----- / CERTIFICATE----- headers)","Include the files in the container/deployment artifact if running in a container"],"exampleFix":"// before\nquarkus.tls.my-tls.key-store.pem.0.key=./server-key.pem\nquarkus.tls.my-tls.key-store.pem.0.cert=./server-cert.pem\n// after\nquarkus.tls.my-tls.key-store.pem.0.key=/etc/app/certs/server-key.pem\nquarkus.tls.my-tls.key-store.pem.0.cert=/etc/app/certs/server-cert.pem","handlingStrategy":"validation","validationCode":"Stream.of(keyPath, certPath).forEach(p -> {\n    File f = new File(p);\n    if (!f.isFile()) throw new IllegalStateException(\"Missing PEM file: \" + p);\n    if (!f.canRead()) throw new IllegalStateException(\"Unreadable PEM file: \" + p);\n});","typeGuard":null,"tryCatchPattern":"try {\n    // use TLS config\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"cannot read the key/certificate files\")) {\n        log.errorf(e.getCause(), \"PEM key/cert unreadable for %s\", certName);\n    }\n}","preventionTips":["Use absolute paths and mount PEM files into containers explicitly","Prefer unencrypted PKCS#8 PEM keys (openssl pkcs8 -topk8 -nocrypt)","Verify file permissions for the user running the JVM","Test path resolution in the actual runtime environment, not just locally"],"tags":["tls","pem","io","file-not-found"],"backgroundTag":"pem-file-unreadable","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}