eclipse-vertx/vert.x · error · RuntimeException

Missing -----BEGIN CERTIFICATE----- delimiter

Error message

Missing -----BEGIN CERTIFICATE----- delimiter

What it means

loadCerts() throws 'Missing -----BEGIN CERTIFICATE----- delimiter' when the buffer contains no CERTIFICATE PEM block at all (or only unrecognized block types). The certificate option was given content that is not a PEM certificate chain.

Source

Thrown at vertx-core/src/main/java/io/vertx/core/net/impl/KeyStoreHelper.java:399

  private static X509Certificate[] loadCerts(Buffer buffer) throws Exception {
    if (buffer == null) {
      throw new RuntimeException("Missing X.509 certificate path");
    }
    CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
    List<X509Certificate> certs = loadPems(buffer, (delimiter, content) -> {
      try {
        switch (delimiter) {
          case "CERTIFICATE":
            return (Collection<X509Certificate>) certFactory.generateCertificates(new ByteArrayInputStream(content));
          default:
            return Collections.emptyList();
        }
      } catch (CertificateException e) {
        throw new VertxException(e);
      }
    });
    if (certs.isEmpty()) {
      throw new RuntimeException("Missing -----BEGIN CERTIFICATE----- delimiter");
    }
    return certs.toArray(new X509Certificate[0]);
  }

  /**
   * Creates an empty keystore. The keystore uses the default keystore type set in
   * the file 'lib/security/security.java' (located in the JRE) by the 'keystore.type' property.
   * However, if the default is set to the 'JKS' format, the this function will instead attempt to
   * use the newer 'PKCS12' format, if it exists.
   *
   * The PKCS12 format is the default format for keystores for Java >=9 and available on GraalVM.
   *
   * PKCS12 is an extensible, standard, and widely-supported format for storing cryptographic keys.
   * As of JDK 8, PKCS12 keystores can store private keys, trusted public key certificates, and
   * secret keys.
   *
   * The "old" default "JKS" (available since Java 1.2) can only store private keys and trusted
   * public-key certificates, and they are based on a proprietary format that is not easily

View on GitHub (pinned to fb308bd8c3)

Solutions

1. Verify the file starts with -----BEGIN CERTIFICATE----- (head -1 cert.pem).
2. Swap cert/key options if they were reversed.
3. Export PEM certificates from the binary store: openssl pkcs12 -in store.pfx -clcerts -nokeys -out cert.pem.
4. Ensure the mounted secret/configmap actually contains the certificate.

Example fix

// before
options.setCertPath("server.key"); // wrong file
// after
options.setCertPath("server.crt"); // -----BEGIN CERTIFICATE-----

String head = Files.readString(Path.of(certPath)).stripLeading();
if (!head.startsWith("-----BEGIN CERTIFICATE-----"))
    throw new IllegalStateException(certPath + " is not a PEM certificate chain");

boolean isPemCertificate(String s) {
  return s != null && s.contains("-----BEGIN CERTIFICATE-----");
}

When it happens

Trigger: setCertPath/setCertValue pointing at a key file, a PKCS12 binary, or a file with only non-certificate blocks; empty trust config file.

Common situations: Swapping cert and key paths in configuration; mounting the wrong secret key; trusting a binary .pfx where PEM expected.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Missing -----BEGIN PRIVATE KEY----- or -----BEGIN RSA PRIVAT
• Missing -----END ----- delimiter
• Empty pem file
• SSL configuration is necessary for a QUIC server
• Not listening

AI-assisted analysis of eclipse-vertx/vert.x@fb308bd8c3 (2026-09-06). Data as JSON: /api/errors/9ebc04bf4d0b202e. Report an issue: GitHub.