{"record":{"id":"edb2f20b7b7f9e9d","repo":"apache/pulsar","slug":"cert-key-file-path-or-cert-key-stream-must-be-pres","errorCode":null,"errorMessage":"cert/key file path or cert/key stream must be present","messagePattern":"cert/key file path or cert/key stream must be present","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationTls.java","lineNumber":91,"sourceCode":"\n    @Override\n    public String getAuthMethodName() {\n        return AUTH_METHOD_NAME;\n    }\n\n    @SuppressWarnings(\"deprecation\")\n    @Override\n    public AuthenticationDataProvider getAuthData() throws PulsarClientException {\n        try {\n            if (certFilePath != null && keyFilePath != null) {\n                return new AuthenticationDataTls(certFilePath, keyFilePath);\n            } else if (certStreamProvider != null && keyStreamProvider != null) {\n                return new AuthenticationDataTls(certStreamProvider, keyStreamProvider, trustStoreStreamProvider);\n            }\n        } catch (Exception e) {\n            throw new PulsarClientException(e);\n        }\n        throw new IllegalArgumentException(\"cert/key file path or cert/key stream must be present\");\n    }\n\n    @Override\n    public void configure(String encodedAuthParamString) {\n        Map<String, String> authParamsMap = null;\n        try {\n            authParamsMap = AuthenticationUtil.configureFromJsonString(encodedAuthParamString);\n        } catch (Exception e) {\n            // auth-param is not in json format\n        }\n        authParamsMap = (authParamsMap == null || authParamsMap.isEmpty())\n                ? AuthenticationUtil.configureFromPulsar1AuthParamString(encodedAuthParamString)\n                : authParamsMap;\n        setAuthParams(authParamsMap);\n    }\n\n    @Override\n    @Deprecated","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-client/src/main/java/org/apache/pulsar/client/impl/auth/AuthenticationTls.java#L73-L109","documentation":"AuthenticationTls.getAuthData() builds TLS credentials from either file paths (setTlsFilePath) or stream providers (setCertStreamProvider/setKeyStreamProvider). If, after configuration, none of cert path/key path, cert/key streams, or a trust store stream provider combination is present, it throws this IllegalArgumentException because it cannot construct AuthenticationDataTls without any certificate/key material.","triggerScenarios":"Calling getAuthData() on an AuthenticationTls instance where neither setTlsFilePath(certFile, keyFile) nor setCertStreamProvider+setKeyStreamProvider was called, or where configure() was given an empty/blank authParams map so no fields were populated.","commonSituations":"Building a PulsarClient with AuthenticationTls but forgetting to set the authParams JSON (tlsCertFile/tlsKeyFile); using setTlsFilePath with only one of cert or key; refactoring code that previously set paths and accidentally removing the configuration call.","solutions":["Call authentication.setTlsFilePath(certFile, keyFile) with valid existing file paths before getAuthData().","Alternatively call setCertStreamProvider(...) and setKeyStreamProvider(...) with InputStream suppliers.","If using configure(authParams), ensure the params string contains both tlsCertFile and tlsKeyFile keys with non-blank values."],"exampleFix":"// before\nAuthenticationTls auth = new AuthenticationTls();\nPulsarClient client = PulsarClient.builder().authentication(auth).build(); // throws\n// after\nAuthenticationTls auth = new AuthenticationTls();\nauth.setTlsFilePath(\"/etc/pulsar/cert.pem\", \"/etc/pulsar/key.pem\");\nPulsarClient client = PulsarClient.builder().authentication(auth).build();","handlingStrategy":"validation","validationCode":"AuthenticationTls auth = new AuthenticationTls();\nif (certFile != null && keyFile != null && new File(certFile).exists() && new File(keyFile).exists()) {\n    auth.setTlsFilePath(certFile, keyFile);\n} else if (certStreamProvider != null && keyStreamProvider != null) {\n    auth.setCertStreamProvider(certStreamProvider);\n    auth.setKeyStreamProvider(keyStreamProvider);\n} else {\n    throw new IllegalStateException(\"TLS auth requires either cert/key file paths or cert/key stream providers\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    AuthenticationDataTls data = (AuthenticationDataTls) auth.getAuthData();\n} catch (IllegalArgumentException e) {\n    log.error(\"TLS auth not configured: {}\", e.getMessage());\n    throw new ConfigurationException(\"Set tlsCertFile/tlsKeyFile or stream providers\", e);\n}","preventionTips":["Always call setTlsFilePath or the stream-provider setters immediately after constructing AuthenticationTls.","Check both cert and key are set — one alone is not enough.","Validate file existence before building the client."],"tags":["pulsar-client","tls","authentication","configuration"],"backgroundTag":"missing-tls-credentials","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}