quarkusio/quarkus · error · IllegalStateException

Invalid PEM trusted certificates configuration for certifica

Error message

Invalid PEM trusted certificates configuration for certificate '${name}' - cannot read the PEM certificate files

What it means

Thrown when the PEM trusted certificate files configured for a trust store cannot be read from disk — loadKeyStore raised an UncheckedIOException. The config is present and non-empty, but the certificate files are missing, unreadable, or invalid PEM.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/PemKeyStores.java:54

        }
    }

    public static TrustStoreAndTrustOptions verifyPEMTrustStoreStore(TrustStoreConfig tsc, Vertx vertx, String name) {
        var config = tsc.pem().orElseThrow();
        if (config.hasNoTrustedCertificates()) {
            throw new IllegalStateException("No PEM certificates configured for the trust store of '" + name + "'");
        }
        try {
            var options = config.toOptions();
            KeyStore ks = options.loadKeyStore(vertx);
            if (tsc.certificateExpirationPolicy() == TrustStoreConfig.CertificateExpiryPolicy.IGNORE) {
                return new TrustStoreAndTrustOptions(ks, options);
            } else {
                var wrapped = new ExpiryTrustOptions(options, tsc.certificateExpirationPolicy());
                return new TrustStoreAndTrustOptions(ks, wrapped);
            }
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid PEM trusted certificates configuration for certificate '" + name
                    + "' - cannot read the PEM certificate files", e);
        } catch (Exception e) {
            throw new IllegalStateException("Invalid PEM trusted certificates configuration for certificate '" + name + "'", e);
        }
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

Verify each quarkus.tls.<name>.trust-store.pem.<n>.cert file exists and is readable
Use absolute paths and mount CA files into containers explicitly
Ensure files contain PEM text (-----BEGIN CERTIFICATE-----); convert DER: openssl x509 -inform der -in cert.cer -out cert.pem
Validate parsing with openssl x509 -in cert.pem -noout -text

Example fix

// before
quarkus.tls.my-tls.trust-store.pem.0.cert=./ca-bundle.cer
// after (converted to PEM, absolute path)
quarkus.tls.my-tls.trust-store.pem.0.cert=/etc/app/certs/ca-bundle.pem

Defensive patterns

Strategy: validation

Validate before calling

Stream.of(certPaths).forEach(p -> {
    String content;
    try { content = new String(Files.readAllBytes(Paths.get(p)), StandardCharsets.UTF_8); }
    catch (IOException e) { throw new IllegalStateException("Unreadable cert: " + p, e); }
    if (!content.contains("-----BEGIN CERTIFICATE-----")) {
        throw new IllegalStateException("Not PEM: " + p);
    }
});

Try / catch

try {
    // use TLS config
} catch (IllegalStateException e) {
    if (e.getMessage().contains("cannot read the PEM certificate files")) {
        log.errorf(e.getCause(), "PEM trust certs unreadable for %s", certName);
    }
}

Prevention

Convert DER certs to PEM before use: openssl x509 -inform der -outform pem
Mount CA bundles into containers and reference absolute paths
Validate bundles with openssl after every CA renewal
Check read permissions in hardened environments

When it happens

Trigger: verifyPEMTrustStoreStore catches UncheckedIOException while reading the configured PEM certificate files: wrong paths, missing files in the deployment, no read permission, or content that is not parseable PEM.

Common situations: CA bundle file not mounted in container; single-file bundle path renamed after CA renewal; file contains other formats (DER) instead of PEM; permissions stripped by security hardening.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/eacd38402cfdfd4d. Report an issue: GitHub.