quarkusio/quarkus · error · IllegalStateException

No PEM certificates configured for the trust store of '${nam

Error message

No PEM certificates configured for the trust store of '${name}'

What it means

Quarkus TLS registry verifies PEM trust stores before use; if the pem trust store section is present but no trusted certificate files are configured, verification fails. A trust store with zero trusted certificates is meaningless, so the registry rejects it up front.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/PemKeyStores.java:42

        PemKeyCertConfig config = ksc.pem().orElseThrow();
        if (config.keyCerts().isEmpty()) {
            throw new IllegalStateException("No key/certificate pair configured for certificate '" + name + "'");
        }
        try {
            PemKeyCertOptions options = config.toOptions();
            return new KeyStoreAndKeyCertOptions(options.loadKeyStore(vertx), options);
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid key/certificate pair configuration for certificate '" + name
                    + "' - cannot read the key/certificate files", e);
        } catch (Exception e) {
            throw new IllegalStateException("Invalid key/certificate pair configuration for certificate '" + name + "'", e);
        }
    }

    public static TrustStoreAndTrustOptions verifyPEMTrustStoreStore(TrustStoreConfig tsc, Vertx vertx, String name) {
        var config = tsc.pem().orElseThrow();
        if (config.hasNoTrustedCertificates()) {
            throw new IllegalStateException("No PEM certificates configured for the trust store of '" + name + "'");
        }
        try {
            var options = config.toOptions();
            KeyStore ks = options.loadKeyStore(vertx);
            if (tsc.certificateExpirationPolicy() == TrustStoreConfig.CertificateExpiryPolicy.IGNORE) {
                return new TrustStoreAndTrustOptions(ks, options);
            } else {
                var wrapped = new ExpiryTrustOptions(options, tsc.certificateExpirationPolicy());
                return new TrustStoreAndTrustOptions(ks, wrapped);
            }
        } catch (UncheckedIOException e) {
            throw new IllegalStateException("Invalid PEM trusted certificates configuration for certificate '" + name
                    + "' - cannot read the PEM certificate files", e);
        } catch (Exception e) {
            throw new IllegalStateException("Invalid PEM trusted certificates configuration for certificate '" + name + "'", e);
        }
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

Add at least one trusted certificate: quarkus.tls.<name>.trust-store.pem.0.cert=ca-cert.pem
Check the trust-store.pem.* property names and indexes are correct (cert entries, not key entries)
Remove the empty pem section if PEM trust store is not actually needed

Example fix

// before
quarkus.tls.my-tls.trust-store.pem.enabled=true
// after
quarkus.tls.my-tls.trust-store.pem.0.cert=/etc/app/certs/ca.pem

Defensive patterns

Strategy: validation

Validate before calling

if (ConfigProvider.getConfig()
        .getPropertyNames().stream()
        .noneMatch(p -> p.startsWith("quarkus.tls.my-tls.trust-store.pem."))) {
    throw new IllegalStateException("No PEM trusted certificates configured for my-tls");
}

Try / catch

try {
    TlsConfiguration.from(registry, Optional.of("my-tls"));
} catch (IllegalStateException e) {
    if (e.getMessage().contains("No PEM certificates configured for the trust store")) {
        log.error("Add quarkus.tls.my-tls.trust-store.pem.<n>.cert properties");
    }
}

Prevention

Always add at least one pem.<n>.cert entry when enabling the PEM trust store
Use trust-store.pem.* (cert only), not key-store-style key/cert pairs
Remove the pem trust store section entirely if it is not used

When it happens

Trigger: Calling verifyPEMTrustStoreStore where the PemTrustCertConfig hasNoTrustedCertificates() returns true — e.g. quarkus.tls.<name>.trust-store.pem defined but no pem.<n>.cert properties set.

Common situations: Trust store enabled but certificate list left empty; all cert entries removed in config refactoring; property prefix typo so entries are not picked up; copying a key-store-style config (with key/cert pairs) instead of the trust-store format.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/9d25897ea40b38ff. Report an issue: GitHub.