eclipse-vertx/vert.x · error · RuntimeException
Empty pem file
Error message
Empty pem file
What it means
After matching a BEGIN/END pair, loadPems() strips whitespace from the base64 body and throws 'Empty pem file' if nothing remains. This means the PEM delimiters enclose no data — an empty or whitespace-only block.
Source
Thrown at vertx-core/src/main/java/io/vertx/core/net/impl/KeyStoreHelper.java:371
Matcher endMatcher = END_PATTERN.matcher(pem);
while (true) {
boolean begin = beginMatcher.find();
if (!begin) {
break;
}
String beginDelimiter = beginMatcher.group(1);
boolean end = endMatcher.find();
if (!end) {
throw new RuntimeException("Missing -----END " + beginDelimiter + "----- delimiter");
} else {
String endDelimiter = endMatcher.group(1);
if (!beginDelimiter.equals(endDelimiter)) {
throw new RuntimeException("Missing -----END " + beginDelimiter + "----- delimiter");
} else {
String content = pem.substring(beginMatcher.end(), endMatcher.start());
content = content.replaceAll("\\s", "");
if (content.length() == 0) {
throw new RuntimeException("Empty pem file");
}
Collection<P> pemItems = pemFact.apply(endDelimiter, Base64.getDecoder().decode(content));
pems.addAll(pemItems);
}
}
}
return pems;
}
private static X509Certificate[] loadCerts(Buffer buffer) throws Exception {
if (buffer == null) {
throw new RuntimeException("Missing X.509 certificate path");
}
CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
List<X509Certificate> certs = loadPems(buffer, (delimiter, content) -> {
try {
switch (delimiter) {
case "CERTIFICATE":View on GitHub (pinned to fb308bd8c3)
Solutions
- Inspect the file between the BEGIN/END lines — it must contain base64 lines; restore the actual key/cert material.
- Re-export the certificate/key from its source (openssl, keystore, cert manager).
- Fix the templating/secret value that produced an empty body.
- Validate before use: openssl x509 -in file -noout fails on empty bodies.
Example fix
// before (empty body) -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- // after -----BEGIN CERTIFICATE----- MIIDdTCCAl2gAwIBAgI... -----END CERTIFICATE-----
Defensive patterns
Strategy: validation
Validate before calling
String body = pem.replaceAll("(?s).*?-----BEGIN [^-]+-----", "").replaceAll("-----END.*", "").replaceAll("\\s", "");
if (body.isEmpty()) throw new IllegalStateException("PEM block has empty body: " + pemPath); Prevention
- Check secret values are non-empty when creating configmaps/secrets
- Fail fast on empty TLS files at application startup
- Use templates with strict variable interpolation so unset vars error out
- Validate with openssl x509 before deployment
When it happens
Trigger: A PEM file containing only delimiter lines (secret created from empty value), a template variable that interpolated to nothing between BEGIN/END, or a file where all body lines were lost.
Common situations: Kubernetes secrets rendered with an unset env var; copy-paste that skipped the base64 body; backup tooling that stored headers only.
Related errors
- Missing -----BEGIN PRIVATE KEY----- or -----BEGIN RSA PRIVAT
- Missing -----END ----- delimiter
- Missing -----BEGIN CERTIFICATE----- delimiter
- SSL configuration is necessary for a QUIC server
- Not listening
AI-assisted analysis of eclipse-vertx/vert.x@fb308bd8c3 (2026-09-06).
Data as JSON: /api/errors/108a108234e85574.
Report an issue: GitHub.