apple/pkl · error · HttpClientException

emptyCertFile

emptyCertFile

Error message

emptyCertFile: ${source}

What it means

Pkl opened a configured certificate source (file or inline bytes) and found it completely empty (zero bytes). collectCertificates peeks at the first byte and throws this error when EOF is reached immediately, since an empty stream cannot contain any certificate.

Source

Thrown at pkl-core/src/main/java/org/pkl/core/http/JdkHttpClient.java:185

    }
    for (var byteBuffer : certificateBytes) {
      var stream = new ByteArrayInputStream(byteBuffer.array());
      collectCertificates(certificates, factory, stream, "<unavailable>");
    }
    return certificates;
  }

  private static void collectCertificates(
      ArrayList<Certificate> anchors,
      CertificateFactory factory,
      InputStream stream,
      Object source) {
    var input = new PushbackInputStream(stream);

    try {
      var peekByte = input.read();
      if (peekByte == -1) {
        throw new HttpClientException(ErrorMessages.create("emptyCertFile", source));
      } else {
        input.unread(peekByte);
      }
    } catch (IOException e) {
      throw new HttpClientException(
          ErrorMessages.create("cannotParseCertFile", source, Exceptions.getRootReason(e)));
    }

    var first = true;
    while (true) {
      try {
        anchors.add(factory.generateCertificate(input));
      } catch (CertificateException e) {
        if (e.getCause() instanceof IOException ioExc) {
          if (Objects.equals(ioExc.getMessage(), "Empty input")) {
            if (first) {
              throw new HttpClientException(
                  ErrorMessages.create("cannotParseCertFile", source, "No certificate data found"));

View on GitHub (pinned to f3efcbfc9b)

Solutions

1. Check the file size (`ls -l <path>` / `stat`); replace the empty file with a real PEM/DER certificate.
2. Re-download or re-export the certificate from the source CA; verify it contains PEM blocks (`-----BEGIN CERTIFICATE-----`).
3. If using certificateBytes, verify the byte array is populated before passing it to the client.
4. Fix the path if the empty file is not the intended certificate.

Example fix

// before (shell)
$ stat -c %s ca.pem
0
// after (shell)
$ cp /etc/ssl/certs/ca-certificates.crt ca.pem && head -1 ca.pem
-----BEGIN CERTIFICATE-----

Path certFile = Paths.get(caCertPath);
try {
  if (Files.size(certFile) == 0) {
    throw new IllegalStateException("Certificate file is empty: " + certFile);
  }
  String head = Files.readString(certFile).strip();
  if (!head.startsWith("-----BEGIN")) {
    throw new IllegalStateException("Not a PEM certificate: " + certFile);
  }
} catch (IOException e) {
  throw new IllegalStateException("Cannot inspect cert file", e);
}

try {
  // configure HTTP client
} catch (HttpClientException e) {
  if (e.getMessage().startsWith("emptyCertFile")) {
    // re-fetch or substitute a valid certificate
  }
}

When it happens

Trigger: A certificate file configured via certificateFiles has zero length, or a certificateBytes buffer is empty (array with no bytes); the PushbackInputStream.read() returns -1 in collectCertificates.

Common situations: A `touch`-created placeholder cert file, a truncated download that produced a 0-byte file, a config pointing at a log or lock file, or build steps that created an empty output artifact.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• cannotFindCertFile
• cannotReadCertFile
• cannotParseCertFile
• malformedProxyAddress
• No security manager set.

AI-assisted analysis of apple/pkl@f3efcbfc9b (2026-09-08). Data as JSON: /api/errors/380fdfe10a05adc8. Report an issue: GitHub.