{"record":{"id":"eacd38402cfdfd4d","repo":"quarkusio/quarkus","slug":"invalid-pem-trusted-certificates-configuration-for","errorCode":null,"errorMessage":"Invalid PEM trusted certificates configuration for certificate '${name}' - cannot read the PEM certificate files","messagePattern":"Invalid PEM trusted certificates configuration for certificate '(.+?)' - cannot read the PEM certificate files","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/PemKeyStores.java","lineNumber":54,"sourceCode":"        }\n    }\n\n    public static TrustStoreAndTrustOptions verifyPEMTrustStoreStore(TrustStoreConfig tsc, Vertx vertx, String name) {\n        var config = tsc.pem().orElseThrow();\n        if (config.hasNoTrustedCertificates()) {\n            throw new IllegalStateException(\"No PEM certificates configured for the trust store of '\" + name + \"'\");\n        }\n        try {\n            var options = config.toOptions();\n            KeyStore ks = options.loadKeyStore(vertx);\n            if (tsc.certificateExpirationPolicy() == TrustStoreConfig.CertificateExpiryPolicy.IGNORE) {\n                return new TrustStoreAndTrustOptions(ks, options);\n            } else {\n                var wrapped = new ExpiryTrustOptions(options, tsc.certificateExpirationPolicy());\n                return new TrustStoreAndTrustOptions(ks, wrapped);\n            }\n        } catch (UncheckedIOException e) {\n            throw new IllegalStateException(\"Invalid PEM trusted certificates configuration for certificate '\" + name\n                    + \"' - cannot read the PEM certificate files\", e);\n        } catch (Exception e) {\n            throw new IllegalStateException(\"Invalid PEM trusted certificates configuration for certificate '\" + name + \"'\", e);\n        }\n    }\n}\n","sourceCodeStart":36,"sourceCodeEnd":61,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/PemKeyStores.java#L36-L61","documentation":"Thrown when the PEM trusted certificate files configured for a trust store cannot be read from disk — loadKeyStore raised an UncheckedIOException. The config is present and non-empty, but the certificate files are missing, unreadable, or invalid PEM.","triggerScenarios":"verifyPEMTrustStoreStore catches UncheckedIOException while reading the configured PEM certificate files: wrong paths, missing files in the deployment, no read permission, or content that is not parseable PEM.","commonSituations":"CA bundle file not mounted in container; single-file bundle path renamed after CA renewal; file contains other formats (DER) instead of PEM; permissions stripped by security hardening.","solutions":["Verify each quarkus.tls.<name>.trust-store.pem.<n>.cert file exists and is readable","Use absolute paths and mount CA files into containers explicitly","Ensure files contain PEM text (-----BEGIN CERTIFICATE-----); convert DER: openssl x509 -inform der -in cert.cer -out cert.pem","Validate parsing with openssl x509 -in cert.pem -noout -text"],"exampleFix":"// before\nquarkus.tls.my-tls.trust-store.pem.0.cert=./ca-bundle.cer\n// after (converted to PEM, absolute path)\nquarkus.tls.my-tls.trust-store.pem.0.cert=/etc/app/certs/ca-bundle.pem","handlingStrategy":"validation","validationCode":"Stream.of(certPaths).forEach(p -> {\n    String content;\n    try { content = new String(Files.readAllBytes(Paths.get(p)), StandardCharsets.UTF_8); }\n    catch (IOException e) { throw new IllegalStateException(\"Unreadable cert: \" + p, e); }\n    if (!content.contains(\"-----BEGIN CERTIFICATE-----\")) {\n        throw new IllegalStateException(\"Not PEM: \" + p);\n    }\n});","typeGuard":null,"tryCatchPattern":"try {\n    // use TLS config\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"cannot read the PEM certificate files\")) {\n        log.errorf(e.getCause(), \"PEM trust certs unreadable for %s\", certName);\n    }\n}","preventionTips":["Convert DER certs to PEM before use: openssl x509 -inform der -outform pem","Mount CA bundles into containers and reference absolute paths","Validate bundles with openssl after every CA renewal","Check read permissions in hardened environments"],"tags":["tls","pem","trust-store","io"],"backgroundTag":"pem-file-unreadable","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}