quarkusio/quarkus · error · RuntimeException

Failed to close directory stream opened for certificate dire

Error message

Failed to close directory stream opened for certificate directory + certDir

What it means

While checking whether any trusted PEM certificate is configured, PemCertsConfig.hasNoTrustedCertificates opens a DirectoryStream per configured cert-dir; if closing the stream (the try-with-resources block) raises an IOException, it is rethrown wrapped in a RuntimeException claiming the stream 'failed to close'. Despite the message, this fires on close(), not on opening.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemCertsConfig.java:47

     * Any file in the configured directories will be treated as a trusted certificate in the Pem format.
     */
    Optional<List<Path>> certDirs();

    default boolean hasNoTrustedCertificates() {
        if (certs().isPresent() && !certs().get().isEmpty()) {
            return false;
        }

        List<Path> certDirs = certDirs().orElse(null);
        if (certDirs != null && !certDirs.isEmpty()) {
            // whether any of certificate directories contains at least one file
            for (Path certDir : certDirs) {
                try (var ds = streamDirectory(certDir)) {
                    if (ds.iterator().hasNext()) {
                        return false;
                    }
                } catch (IOException e) {
                    throw new RuntimeException("Failed to close directory stream opened for certificate directory " + certDir,
                            e);
                }
            }
            var logger = Logger.getLogger(PemCertsConfig.class);
            if (logger.isDebugEnabled()) {
                logger.debugf("There is %d configured directories for the trusted certificates (%s), but "
                        + "none of the directories contains any file", certDirs.size(), certDirs);
            }
        }

        return true;
    }

    default PemTrustOptions toOptions() {
        PemTrustOptions options = new PemTrustOptions();

        var certs = certs().orElse(null);
        if (certs != null) {

View on GitHub (pinned to e1c734241f)

Solutions

Check the chained 'Caused by' IOException for the real filesystem problem
Verify the certDirs paths point to stable, healthy local directories
Move certificate directories onto local storage or a reliable volume
Ensure the directory is readable and not being mutated by another process during startup

Defensive patterns

Strategy: try-catch

Validate before calling

for (Path dir : certDirs) {
    if (!Files.isDirectory(dir)) throw new IllegalStateException("Invalid certDir: " + dir);
    try (var s = Files.list(dir)) { s.findAny(); }
}

Type guard

static boolean isReadableDirectory(Path p) {
    return p != null && Files.isDirectory(p) && Files.isReadable(p);
}

Try / catch

try {
    options = pemCertsConfig.toOptions();
} catch (RuntimeException e) {
    // inspect e.getCause() (IOException) for the real close-time failure
    throw new RuntimeException("Trust cert dir scan failed: " + e.getCause(), e);
}

Prevention

Keep cert directories on local, reliable storage during startup
Avoid mutating cert directories while the app boots
Check 'Caused by' IOException for the real filesystem error
Pre-mount secrets before application startup in Kubernetes

When it happens

Trigger: An IOException thrown by DirectoryStream.close() while iterating certDirs configured via quarkus.tls.key-store/trust-store.pem.certDirs — typically on filesystems where closing a directory handle can fail (NFS stale handles, disks removed mid-scan).

Common situations: Cert directories on network mounts or removable media that disappear or become stale between open and close; container volumes being torn down during startup; underlying I/O errors surfaced at close time.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/9458d138216efb5e. Report an issue: GitHub.