quarkusio/quarkus · error · ConfigurationException

Path '" + certificateDirectory + "' is not a directory. Path

Error message

Path '" + certificateDirectory + "' is not a directory. Paths pointing to the certificate files can be configured with the 'quarkus.tls.trust-store.pem.certs' property instead

What it means

streamDirectory validates that each configured certificate path is a directory; a path that exists but is a regular file throws ConfigurationException telling you a file belongs in the pem.certs (files) property, not pem.certDirs (directories). The two properties have distinct semantics and are not interchangeable.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemCertsConfig.java:98

                            e);
                }
            }
        }

        if (options.getCertValues().isEmpty()) {
            throw new IllegalArgumentException("You must specify the key files and certificate files");
        }

        return options;
    }

    private static DirectoryStream<Path> streamDirectory(Path certificateDirectory) {
        if (Files.notExists(certificateDirectory)) {
            throw new ConfigurationException("Configured certificate path does not exist:" + certificateDirectory);
        }

        if (!Files.isDirectory(certificateDirectory)) {
            throw new ConfigurationException("Path '" + certificateDirectory + "' is not a directory. Paths pointing "
                    + "to the certificate files can be configured with the 'quarkus.tls.trust-store.pem.certs' property"
                    + " instead");
        }

        try {
            return Files.newDirectoryStream(certificateDirectory);
        } catch (IOException e) {
            throw new RuntimeException("Failed to open DirectoryStream for configured certificate path " + certificateDirectory,
                    e);
        }
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

Move the file path to quarkus.tls.<name>.trust-store.pem.certs (files list)
Or create a directory, put the certificates inside it, and point certDirs at the directory
Remember: certDirs expects directories whose files are ALL treated as PEM certs; certs expects explicit file paths

Example fix

// before
quarkus.tls.trust-store.pem.certDirs=/etc/certs/ca.crt
// after
quarkus.tls.trust-store.pem.certs=/etc/certs/ca.crt
# or
quarkus.tls.trust-store.pem.certDirs=/etc/certs

Defensive patterns

Strategy: validation

Validate before calling

for (Path p : certDirs) {
    if (Files.exists(p) && !Files.isDirectory(p))
        throw new IllegalStateException("certDirs expects a directory, got file: " + p);
}

Try / catch

try {
    options = pemCertsConfig.toOptions();
} catch (ConfigurationException e) {
    throw new IllegalStateException("certDirs/certs misuse: " + e.getMessage(), e);
}

Prevention

certDirs = directories; certs = individual file paths — never mix
If automation generates a single file, configure it via pem.certs instead
Resolve symlinks when validating paths (Files.isSymbolicLink)

When it happens

Trigger: quarkus.tls.<name>.trust-store.pem.certDirs points at a single .pem/.crt file instead of a directory containing certificate files.

Common situations: Mixing up certs vs certDirs semantics; copying the value from the certs property into certDirs; automation generating one file and configuring it as a directory; a symlink resolving to a file.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/ef7ade6e6459ddfc. Report an issue: GitHub.