quarkusio/quarkus · error · IllegalStateException

No key/certificate pair configured for certificate '${name}'

Error message

No key/certificate pair configured for certificate '${name}'

What it means

Quarkus TLS registry verifies PEM certificate configurations before use; if the pem section is present but contains no key/certificate file pairs, verification fails immediately. PEM configs must list at least one (key, cert) pair to build a usable keystore.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/PemKeyStores.java:26

import io.quarkus.tls.runtime.config.KeyStoreConfig;
import io.quarkus.tls.runtime.config.PemKeyCertConfig;
import io.quarkus.tls.runtime.config.TrustStoreConfig;
import io.vertx.core.Vertx;
import io.vertx.core.net.PemKeyCertOptions;

/**
 * A utility class to validate PEM key store and trust store configurations.
 */
public class PemKeyStores {

    private PemKeyStores() {
        // Avoid direct instantiation
    }

    public static KeyStoreAndKeyCertOptions verifyPEMKeyStore(KeyStoreConfig ksc, Vertx vertx, String name) {
        PemKeyCertConfig config = ksc.pem().orElseThrow();
        if (config.keyCerts().isEmpty()) {
            throw new IllegalStateException("No key/certificate pair configured for certificate '" + name + "'");
        }
        try {
            PemKeyCertOptions options = config.toOptions();
            return new KeyStoreAndKeyCertOptions(options.loadKeyStore(vertx), options);
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid key/certificate pair configuration for certificate '" + name
                    + "' - cannot read the key/certificate files", e);
        } catch (Exception e) {
            throw new IllegalStateException("Invalid key/certificate pair configuration for certificate '" + name + "'", e);
        }
    }

    public static TrustStoreAndTrustOptions verifyPEMTrustStoreStore(TrustStoreConfig tsc, Vertx vertx, String name) {
        var config = tsc.pem().orElseThrow();
        if (config.hasNoTrustedCertificates()) {
            throw new IllegalStateException("No PEM certificates configured for the trust store of '" + name + "'");
        }
        try {

View on GitHub (pinned to e1c734241f)

Solutions

Add at least one key/cert pair: quarkus.tls.<name>.key-store.pem.0.key=... and quarkus.tls.<name>.key-store.pem.0.cert=...
Check file paths are absolute or resolvable and point to unencrypted PEM files
If PEM is not needed, remove the whole quarkus.tls.<name>.key-store.pem section instead of leaving it empty

Example fix

// before
quarkus.tls.my-tls.key-store.pem.enabled=true
// no pairs defined
// after
quarkus.tls.my-tls.key-store.pem.0.key=conf/server-key.pem
quarkus.tls.my-tls.key-store.pem.0.cert=conf/server-cert.pem

Defensive patterns

Strategy: validation

Validate before calling

// fail fast at startup if PEM pairs are not configured
if (ConfigProvider.getConfig()
        .getPropertyNames().stream()
        .noneMatch(p -> p.startsWith("quarkus.tls.my-tls.key-store.pem."))) {
    throw new IllegalStateException("No PEM key/cert pairs configured for my-tls");
}

Try / catch

try {
    TlsConfiguration.from(registry, Optional.of("my-tls"));
} catch (IllegalStateException e) {
    if (e.getMessage().contains("No key/certificate pair configured")) {
        log.error("Add quarkus.tls.my-tls.key-store.pem.<n>.key/.cert properties");
    }
}

Prevention

Always set both pem.<n>.key and pem.<n>.cert when enabling the pem section
Never leave a pem section enabled with zero entries; remove it entirely if unused
Document required PEM properties for your deployment profile

When it happens

Trigger: Calling verifyPEMKeyStore with a KeyStoreConfig whose PemKeyCertConfig.keyCerts() is empty — e.g. quarkus.tls.<name>.key-store.pem defined but no pem.<n>.key / pem.<n>.cert entries set.

Common situations: User enables PEM key store config but forgets to add the key/cert file properties; all pairs were removed during config cleanup while the pem section remained; property names mis-typed so entries do not register.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/2d3e566ed0b7396c. Report an issue: GitHub.