quarkusio/quarkus · error · UncheckedIOException

Unable to read file + path

Error message

Unable to read file + path

What it means

TlsConfigUtils.read loads a file referenced by TLS configuration into a byte buffer. When Files.newInputStream(path) throws IOException (file missing, unreadable, is a directory), the IOException is wrapped in this UncheckedIOException.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/TlsConfigUtils.java:53

     * @param path the path, must not be {@code null}
     * @return the content of the file
     */
    public static byte[] read(Path path) {
        byte[] data;
        try {
            final InputStream resource = Thread.currentThread().getContextClassLoader()
                    .getResourceAsStream(ClassPathUtils.toResourceName(path));
            if (resource != null) {
                try (InputStream is = resource) {
                    data = is.readAllBytes();
                }
            } else {
                try (InputStream is = Files.newInputStream(path)) {
                    data = is.readAllBytes();
                }
            }
        } catch (IOException e) {
            throw new UncheckedIOException("Unable to read file " + path, e);
        }
        return data;
    }

    /**
     * Apply common SSL properties from a {@link SSLOptions} to a {@link TCPSSLOptions}.
     */
    private static void applySSLOptions(TCPSSLOptions options, SSLOptions sslOptions) {
        if (sslOptions != null) {
            options.setSslHandshakeTimeout(sslOptions.getSslHandshakeTimeout());
            options.setSslHandshakeTimeoutUnit(sslOptions.getSslHandshakeTimeoutUnit());
            for (String suite : sslOptions.getEnabledCipherSuites()) {
                options.addEnabledCipherSuite(suite);
            }
            for (Buffer buffer : sslOptions.getCrlValues()) {
                options.addCrlValue(buffer);
            }
            options.setEnabledSecureTransportProtocols(sslOptions.getEnabledSecureTransportProtocols());

View on GitHub (pinned to e1c734241f)

Solutions

  1. Verify the file exists and is readable at the resolved path (ls -l / cat)
  2. Use an absolute path or confirm the working directory the app runs with
  3. If in a container/native image, ensure the file is included in the image and referenced by an absolute path
  4. Check file permissions of the process user

Example fix

// before
quarkus.tls.my-tls.trust-store.pem.0.cert=./certs/ca.pem
// after (absolute path, guaranteed present)
quarkus.tls.my-tls.trust-store.pem.0.cert=/etc/quarkus/certs/ca.pem
Defensive patterns

Strategy: validation

Validate before calling

Path p = Path.of(configuredPath);
if (!Files.isRegularFile(p) || !Files.isReadable(p)) {
    throw new IllegalStateException("TLS file missing or unreadable: " + p.toAbsolutePath());
}

Try / catch

try {
    startApplication();
} catch (UncheckedIOException e) {
    if (e.getMessage().startsWith("Unable to read file")) {
        log.errorf("TLS file unreadable: %s — check path, packaging, permissions", e.getCause());
    }
    throw e;
}

Prevention

When it happens

Trigger: Any TLS config property pointing at a file path (key, cert, truststore, keystore) whose Path cannot be opened: file does not exist, no read permission, wrong working directory for relative paths, or path points to a directory.

Common situations: Typo in file name; relative path resolved against an unexpected base dir (dev vs test vs container); file not copied into the container/native image; permissions changed after deployment.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/ab5169e4f30b9813. Report an issue: GitHub.