quarkusio/quarkus · error · IllegalArgumentException

The key/cert pair with the name '" + name + "' is not found

Error message

The key/cert pair with the name '" + name + "' is not found in the `order` list: + order().get()

What it means

Each name in pem.order must match a keyCerts map key; PemKeyCertConfig.toOptions() throws IllegalArgumentException when an ordered name has no corresponding keyCerts entry, since ordering cannot reference a nonexistent key/cert pair. Note the message text says 'not found in the `order` list' but the real mismatch is with the keyCerts map.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemKeyCertConfig.java:55

        PemKeyCertOptions options = new PemKeyCertOptions();

        if (keyCerts().isEmpty()) {
            throw new IllegalArgumentException("You must specify the key files and certificate files");
        }

        List<KeyCertConfig> orderedListOfPair = new ArrayList<>();
        if (order().isPresent()) {
            // Check the size of the order list. It must match the size of the keyCerts map.
            if (order().get().size() != keyCerts().size()) {
                throw new IllegalArgumentException("The size of the `order` list (" + order().get().size() + ") must " +
                        "match the size of the `keyCerts` map (" + keyCerts().size() + ")");
            }

            // We use the order specified by the user.
            for (String name : order().get()) {
                KeyCertConfig keyCert = keyCerts().get(name);
                if (keyCert == null) {
                    throw new IllegalArgumentException("The key/cert pair with the name '" + name
                            + "' is not found in the `order` list: " + order().get());
                }
                orderedListOfPair.add(keyCert);
            }
        } else {
            // Use the lexical order.
            orderedListOfPair.addAll(new TreeMap<>(keyCerts()).values());
        }

        for (KeyCertConfig config : orderedListOfPair) {
            options.addCertValue(Buffer.buffer(read(config.cert())));
            if (config.password().isPresent()) {
                byte[] content = read(config.key());
                String contentAsString = new String(content, StandardCharsets.UTF_8);
                Buffer decrypted = new EncryptedPKCS8Parser().decryptKey(contentAsString, config.password().get());
                if (decrypted == null) {
                    throw new IllegalArgumentException("Unable to decrypt the key file: " + config.key());
                }

View on GitHub (pinned to e1c734241f)

Solutions

Align every order entry with an existing keyCerts alias name (fix typos/case)
Remove stale names from order, or add the missing keyCerts.<alias> entries
Temporarily delete order to let lexical ordering work while you fix the names
Log/inspect resolved SmallRye Config properties to see the actual keyCerts keys at runtime

Example fix

// before
quarkus.tls.my.key-store.pem.keyCerts.server.cert=cert.crt
quarkus.tls.my.key-store.pem.order=servr   # typo
// after
quarkus.tls.my.key-store.pem.order=server

Defensive patterns

Strategy: validation

Validate before calling

var pem = tlsConfig.keyStore().pem().get();
if (pem.order().isPresent())
    for (String name : pem.order().get())
        if (!pem.keyCerts().containsKey(name))
            throw new IllegalStateException("pem.order references unknown alias: " + name);

Try / catch

try {
    options = pemKeyCertConfig.toOptions();
} catch (IllegalArgumentException e) {
    // message names the offending alias; log keyCerts keys for comparison
    throw new IllegalStateException("Order alias mismatch with keyCerts keys", e);
}

Prevention

Copy alias names exactly (case, spelling, no trailing spaces) between keyCerts and order
Rename keyCerts aliases and order entries in the same commit
When in doubt, remove order temporarily — lexical order is the safe default
Trim/normalize alias names when sourced from environment variables

When it happens

Trigger: quarkus.tls.<name>.key-store.pem.order contains an alias string that is not a key under quarkus.tls.<name>.key-store.pem.keyCerts (typo, renamed alias, stale entry, or quoting/indexing difference in the property name).

Common situations: Typos in the order list (e.g. 'prod ' with trailing space, wrong case); renaming keyCerts.<alias> entries without updating order; environment variables overriding only some keyCerts keys so the order entry no longer resolves; copy-pasting order values between keystore names.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/b73c23d522be8316. Report an issue: GitHub.