quarkusio/quarkus · error · ConfigurationException

Configured certificate path does not exist: + certificateDir

Error message

Configured certificate path does not exist: + certificateDirectory

What it means

Before opening a directory of trusted certificates, PemCertsConfig.streamDirectory verifies the path exists; if not it throws a Quarkus ConfigurationException 'Configured certificate path does not exist:<path>'. This fails fast at configuration/build time rather than later during a TLS handshake.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemCertsConfig.java:94

                        options.addCertValue(Buffer.buffer(read(cert)));
                    }
                } catch (IOException e) {
                    throw new RuntimeException("Failed to close directory stream opened for certificate directory " + certDir,
                            e);
                }
            }
        }

        if (options.getCertValues().isEmpty()) {
            throw new IllegalArgumentException("You must specify the key files and certificate files");
        }

        return options;
    }

    private static DirectoryStream<Path> streamDirectory(Path certificateDirectory) {
        if (Files.notExists(certificateDirectory)) {
            throw new ConfigurationException("Configured certificate path does not exist:" + certificateDirectory);
        }

        if (!Files.isDirectory(certificateDirectory)) {
            throw new ConfigurationException("Path '" + certificateDirectory + "' is not a directory. Paths pointing "
                    + "to the certificate files can be configured with the 'quarkus.tls.trust-store.pem.certs' property"
                    + " instead");
        }

        try {
            return Files.newDirectoryStream(certificateDirectory);
        } catch (IOException e) {
            throw new RuntimeException("Failed to open DirectoryStream for configured certificate path " + certificateDirectory,
                    e);
        }
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

Fix the configured path so it points to an existing directory, ideally absolute
Check the working directory when using relative paths (dev vs test vs prod differ)
In containers, verify the volume/secret mount creates the directory before the app starts
Create the directory if it is intentionally optional but mounted later — or drop the certDirs entry when empty

Example fix

// before
quarkus.tls.trust-store.pem.certDirs=./certificates
// after (absolute path)
quarkus.tls.trust-store.pem.certDirs=/etc/quarkus/certs

Defensive patterns

Strategy: validation

Validate before calling

for (Path dir : certDirs) {
    if (Files.notExists(dir))
        throw new IllegalStateException("certDir does not exist: " + dir.toAbsolutePath());
}

Try / catch

try {
    options = pemCertsConfig.toOptions();
} catch (ConfigurationException e) {
    throw new IllegalStateException("Fix certDirs path: " + e.getMessage(), e);
}

Prevention

Use absolute paths in configuration to avoid working-directory differences
In containers, ensure volumes/secrets are mounted before the app starts
Add a CI check that validates referenced cert paths exist per environment
Watch case sensitivity on Linux filesystems

When it happens

Trigger: quarkus.tls.<name>.trust-store.pem.certDirs (or key-store pem certDirs) references a directory that does not exist on disk when hasNoTrustedCertificates or toOptions runs.

Common situations: Relative path resolved against a different working directory than expected; path only valid in dev but not in the packaged/native runtime; Kubernetes volume not mounted; typo or case-sensitivity mismatch in the path; config still set after the directory was deleted.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/32003205042c3fa7. Report an issue: GitHub.