quarkusio/quarkus · error · IllegalArgumentException

The size of the `order` list (N) must match the size of the

Error message

The size of the `order` list (N) must match the size of the `keyCerts` map (M)

What it means

When the optional pem.order list is provided, PemKeyCertConfig.toOptions() requires it to name every alias in keyCerts exactly — its size must equal keyCerts.size(). A mismatched size throws IllegalArgumentException; order is a permutation list of aliases controlling SNI certificate selection, not a subset filter.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemKeyCertConfig.java:47

     * The order of the key/cert files, based on the names in the `keyCerts` map.
     * <p>
     * By default, Quarkus sorts the key using a lexicographical order.
     * This property allows you to specify the order of the key/cert files.
     */
    Optional<List<String>> order();

    default PemKeyCertOptions toOptions() {
        PemKeyCertOptions options = new PemKeyCertOptions();

        if (keyCerts().isEmpty()) {
            throw new IllegalArgumentException("You must specify the key files and certificate files");
        }

        List<KeyCertConfig> orderedListOfPair = new ArrayList<>();
        if (order().isPresent()) {
            // Check the size of the order list. It must match the size of the keyCerts map.
            if (order().get().size() != keyCerts().size()) {
                throw new IllegalArgumentException("The size of the `order` list (" + order().get().size() + ") must " +
                        "match the size of the `keyCerts` map (" + keyCerts().size() + ")");
            }

            // We use the order specified by the user.
            for (String name : order().get()) {
                KeyCertConfig keyCert = keyCerts().get(name);
                if (keyCert == null) {
                    throw new IllegalArgumentException("The key/cert pair with the name '" + name
                            + "' is not found in the `order` list: " + order().get());
                }
                orderedListOfPair.add(keyCert);
            }
        } else {
            // Use the lexical order.
            orderedListOfPair.addAll(new TreeMap<>(keyCerts()).values());
        }

        for (KeyCertConfig config : orderedListOfPair) {

View on GitHub (pinned to e1c734241f)

Solutions

Update order to list exactly all keyCerts aliases (each exactly once)
Remove the order property entirely — aliases are then used in lexical order
Reconcile environment-specific config fragments so all profiles define the same alias set

Example fix

// before (2 keyCerts, 1 order entry)
quarkus.tls.my.key-store.pem.keyCerts.a.cert=cert-a.crt
quarkus.tls.my.key-store.pem.keyCerts.b.cert=cert-b.crt
quarkus.tls.my.key-store.pem.order=a
// after
quarkus.tls.my.key-store.pem.order=a,b

Defensive patterns

Strategy: validation

Validate before calling

var pem = tlsConfig.keyStore().pem().get();
if (pem.order().isPresent() && pem.order().get().size() != pem.keyCerts().size())
    throw new IllegalStateException("pem.order size must equal keyCerts size ("
        + pem.order().get().size() + " vs " + pem.keyCerts().size() + ")");

Try / catch

try {
    options = pemKeyCertConfig.toOptions();
} catch (IllegalArgumentException e) {
    throw new IllegalStateException("Reconcile pem.order with keyCerts entries", e);
}

Prevention

Treat order as a full permutation of keyCerts aliases, not a preferred subset
Update order in the same change that adds/removes keyCerts aliases
If alias set varies per environment, skip order and accept lexical ordering
Add an integration test asserting SNI alias resolution for each profile

When it happens

Trigger: quarkus.tls.<name>.key-store.pem.order lists fewer (or more) alias names than the number of quarkus.tls.<name>.key-store.pem.keyCerts.* entries.

Common situations: Adding a new keyCerts alias without updating order; removing an alias but leaving it in order (count mismatch in the other direction); configuring order from environment-specific property fragments where only some aliases are defined; hand-writing order expecting it to mean 'preferred subset'.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/c1c7adea4149662b. Report an issue: GitHub.