quarkusio/quarkus · error · IllegalArgumentException

You must specify the key files and certificate files

Error message

You must specify the key files and certificate files

What it means

PemCertsConfig.toOptions() requires at least one trusted certificate; if neither pem.certs nor pem.certDirs yields any certificate values, it throws an IllegalArgumentException stating that key and certificate files must be specified. This guards against silently creating an empty trust options object that would trust nothing.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/config/PemCertsConfig.java:86

            }
        }

        List<Path> certDirs = certDirs().orElse(null);
        if (certDirs != null) {
            for (Path certDir : certDirs) {
                try (var ds = streamDirectory(certDir)) {
                    for (Path cert : ds) {
                        options.addCertValue(Buffer.buffer(read(cert)));
                    }
                } catch (IOException e) {
                    throw new RuntimeException("Failed to close directory stream opened for certificate directory " + certDir,
                            e);
                }
            }
        }

        if (options.getCertValues().isEmpty()) {
            throw new IllegalArgumentException("You must specify the key files and certificate files");
        }

        return options;
    }

    private static DirectoryStream<Path> streamDirectory(Path certificateDirectory) {
        if (Files.notExists(certificateDirectory)) {
            throw new ConfigurationException("Configured certificate path does not exist:" + certificateDirectory);
        }

        if (!Files.isDirectory(certificateDirectory)) {
            throw new ConfigurationException("Path '" + certificateDirectory + "' is not a directory. Paths pointing "
                    + "to the certificate files can be configured with the 'quarkus.tls.trust-store.pem.certs' property"
                    + " instead");
        }

        try {
            return Files.newDirectoryStream(certificateDirectory);

View on GitHub (pinned to e1c734241f)

Solutions

1. Set quarkus.tls.<name>.trust-store.pem.certs to at least one CA certificate path
2. Or place at least one PEM file into each referenced certDirs directory
3. If using a mounted volume, confirm the secret/configmap actually mounted (kubectl describe pod) and files are present
4. Check property names/typos — e.g. trust-store vs key-store, certs vs certDirs

Example fix

// before
quarkus.tls.trust-store.pem.certDirs=/etc/certs   # directory is empty
// after
quarkus.tls.trust-store.pem.certs=/etc/certs/ca.crt

boolean hasFiles = pemCertsConfig.certs().map(l -> !l.isEmpty()).orElse(false);
boolean hasDirCerts = pemCertsConfig.certDirs().orElse(List.of()).stream()
    .anyMatch(d -> { try (var s = Files.list(d)) { return s.findAny().isPresent(); } catch (IOException e) { return false; } });
if (!hasFiles && !hasDirCerts)
    throw new IllegalStateException("No trusted PEM certificates configured");

try {
    PemTrustOptions opts = pemCertsConfig.toOptions();
} catch (IllegalArgumentException e) {
    // supply a default CA bundle or abort startup
    throw new IllegalStateException("Trust store empty: configure trust-store.pem.certs", e);
}

When it happens

Trigger: quarkus.tls.<name>.trust-store.pem.certs is unset or empty AND all configured certDirs exist but contain no files, so PemTrustOptions ends with zero cert values.

Common situations: Pointing certDirs at an empty directory (e.g. a Kubernetes mounted secret volume not yet populated, or an initContainer that failed); forgetting to configure trust-store PEM material entirely while enabling mutual TLS; typo in the cert property namespace so nothing is picked up.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• You must specify the key files and certificate files
• Invalid keystore '" + name + "' - Only one keystore type can
• Configured certificate path does not exist: + certificateDir
• Path '" + certificateDirectory + "' is not a directory. Path
• The size of the `order` list (N) must match the size of the

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/061adcf58df10598. Report an issue: GitHub.