quarkusio/quarkus · error · IllegalStateException

Invalid PEM trusted certificates configuration for certifica

Error message

Invalid PEM trusted certificates configuration for certificate '${name}'

What it means

Generic failure while building a keystore from the configured PEM trusted certificates — any non-IO exception is wrapped in this IllegalStateException naming the certificate configuration. It is the catch-all sibling of the 'cannot read the PEM certificate files' error.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/PemKeyStores.java:57

    public static TrustStoreAndTrustOptions verifyPEMTrustStoreStore(TrustStoreConfig tsc, Vertx vertx, String name) {
        var config = tsc.pem().orElseThrow();
        if (config.hasNoTrustedCertificates()) {
            throw new IllegalStateException("No PEM certificates configured for the trust store of '" + name + "'");
        }
        try {
            var options = config.toOptions();
            KeyStore ks = options.loadKeyStore(vertx);
            if (tsc.certificateExpirationPolicy() == TrustStoreConfig.CertificateExpiryPolicy.IGNORE) {
                return new TrustStoreAndTrustOptions(ks, options);
            } else {
                var wrapped = new ExpiryTrustOptions(options, tsc.certificateExpirationPolicy());
                return new TrustStoreAndTrustOptions(ks, wrapped);
            }
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid PEM trusted certificates configuration for certificate '" + name
                    + "' - cannot read the PEM certificate files", e);
        } catch (Exception e) {
            throw new IllegalStateException("Invalid PEM trusted certificates configuration for certificate '" + name + "'", e);
        }
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

Validate each certificate: openssl x509 -in cert.pem -noout -text to confirm parseability
Clean the bundle file of trailing junk, duplicate blocks, or non-PEM text between certificates
Check quarkus.tls.<name>.trust-store.certificate-expiration-policy — set to IGNORE if expired certs are intentionally kept
Re-export the certificates in base64 PEM format

Example fix

// before (bundle with expired CA + strict policy)
quarkus.tls.my-tls.trust-store.pem.0.cert=old-bundle.pem
quarkus.tls.my-tls.trust-store.certificate-expiration-policy=ERROR
// after (renewed bundle)
quarkus.tls.my-tls.trust-store.pem.0.cert=/etc/app/certs/renewed-bundle.pem

Defensive patterns

Strategy: validation

Validate before calling

for (String p : certPaths) {
    CertificateFactory cf = CertificateFactory.getInstance("X.509");
    try (InputStream in = new FileInputStream(p)) {
        Collection<? extends Certificate> certs = cf.generateCertificates(in);
        if (certs.isEmpty()) throw new IllegalStateException("No certs parsed from " + p);
    }
}

Try / catch

try {
    // use TLS config
} catch (IllegalStateException e) {
    if (e.getMessage().contains("Invalid PEM trusted certificates configuration")
            && !e.getMessage().contains("cannot read")) {
        log.errorf(e.getCause(), "Malformed PEM trust certs for %s", certName);
    }
}

Prevention

Pre-parse bundles with CertificateFactory.generateCertificates in a startup health check
Keep bundle files clean: no junk text between/after PEM blocks
Align certificate-expiration-policy with renewal practices (renew instead of IGNORE)
Validate certificates with openssl x509 before packaging

When it happens

Trigger: verifyPEMTrustStoreStore catches a general Exception from config.toOptions(), options.loadKeyStore(vertx), or ExpiryTrustOptions wrapping: certificate parse failures, unsupported encodings, or expiry-policy processing errors that are not UncheckedIOException.

Common situations: Certificate files containing garbage/truncated PEM; intermediate certs concatenated with stray non-PEM text; expired certificates combined with a strict certificate-expiration-policy; duplicate/invalid DER blocks inside a bundle.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/9ad9c0c2b7a60ebc. Report an issue: GitHub.