Code review comment: @fndejong OK, looks good then. We need tests though: could you try to add some integration tests in the undertow/deployment module? There are already a couple of integration tests there. You can use REST assured to test things, no need for curl.  I'm also wondering if you would be interesting in writing some documentation there: https://github.com/quarkusio/quarkus/blob/master/docs/src/main/asciidoc/rest-json-guide.adoc . A new section just before the conclusion would be nice. It's not the perfect place in the long term but for now, it will do.

Code under review:
public SSLContext toSSLContext() throws GeneralSecurityException, IOException {
        
        Logger log = Logger.getLogger("io.quarkus.configuration.ssl");
        final Optional<Path> certFile = certificate.file;
        final Optional<Path> keyFile = certificate.keyFile;
        final Optional<Path> keyStoreFile = certificate.keyStoreFile;
        final String keystorePassword = certificate.keyStorePassword;
        final KeyStore keyStore;
        if (certFile.isPresent() && keyFile.isPresent()) {
            keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
            keyStore.load(null, keystorePassword.toCharArray());
            final Path certPath = certFile.get();
            final Iterator<PemEntry<?>> certItr = Pem.parsePemContent(load(certPath));
            final ArrayList<X509Certificate> certList = new ArrayList<>();
            while (certItr.hasNext()) {
                final PemEntry<?> item = certItr.next();
                final X509Certificate cert = item.tryCast(X509Certificate.class);
                if (cert != null) {
                    certList.add(cert);
                } else {
                    log.warnf("Ignoring non-certificate in certificate file \"%s\" (the type was %s)", certPath,
                            item.getEntry().getClass());
                }
            }
            if (certList.isEmpty()) {
                log.warnf("No certificate found in file \"%s\"", certPath);
            }
            final Path keyPath = keyFile.get();
            final Iterator<PemEntry<?>> keyItr = Pem.parsePemContent(load(keyPath));
            final PrivateKey privateKey;
            for (;;) {
                if (!keyItr.hasNext()) {
                    log.warnf("No key found in file \"%s\"", keyPath);
                    return null;
                }
                final PemEntry<?> next = keyItr.next();
                final PrivateKey entryKey = next.tryCast(PrivateKey.class);
                if (entryKey != null) {
                    privateKey = entryKey;
                    break;
                }
                log.warnf("Ignoring non-key in key file \"%s\" (the type was %s)", keyPath, next.getEntry().getClass());
            }
            if (keyItr.hasNext()) {
                log.warnf("Ignoring extra content in key file \"%s\"", keyPath);
            }
            
            keyStore.setEntry("default", new KeyStore.PrivateKeyEntry(privateKey, certList.toArray(new X509Certificate[0])),
                    new KeyStore.PasswordProtection(keystorePassword.toCharArray()));
        } else if (keyStoreFile.isPresent()) {
            final Path keyStorePath = keyStoreFile.get();
            final Optional<String> keyStoreFileType = certificate.keyStoreFileType;
            final String type;
            if (keyStoreFileType.isPresent()) {
                type = keyStoreFileType.get();
            } else {
                final String pathName = keyStorePath.toString();
                if (pathName.endsWith(".jks")) {
                    type = "jks";
                } else if (pathName.endsWith(".jceks")) {
                    type = "jceks";
                } else if (pathName.endsWith(".p12") || pathName.endsWith(".pkcs12") || pathName.endsWith(".pfx")) {
                    type = "pkcs12";
                } else {
                    
                    type = "jks";
                }
            }
            keyStore = KeyStore.getInstance(type);
            try (InputStream is = Files.newInputStream(keyStorePath)) {
                keyStore.load(is, null);
            }
        } else {
            return null;
        }
        final KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        keyManagerFactory.init(keyStore, keystorePassword.toCharArray());
        final SSLContextBuilder sslContextBuilder = new SSLContextBuilder();
        sslContextBuilder.setCipherSuiteSelector(cipherSuites.orElse(CipherSuiteSelector.openSslDefault()));
        ProtocolSelector protocolSelector;
        if (protocols.isEmpty()) {
            protocolSelector = ProtocolSelector.defaultProtocols();
        } else {
            protocolSelector = ProtocolSelector.empty().add(protocols.toArray(new Protocol[0]));
        }
        sslContextBuilder.setProtocolSelector(protocolSelector);
        sslContextBuilder.setKeyManager((X509ExtendedKeyManager) keyManagerFactory.getKeyManagers()[0]);
        if (sessionCacheSize.isPresent()) {
            sslContextBuilder.setSessionCacheSize(sessionCacheSize.getAsInt());
        }
        if (sessionTimeout.isPresent()) {
            sslContextBuilder.setSessionTimeout((int) min(Integer.MAX_VALUE, sessionTimeout.get().getSeconds()));
        }
        if (providerName.isPresent()) {
            sslContextBuilder.setProviderName(providerName.get());
        }
        return sslContextBuilder.build().create();
    }

Line commented on: new KeyStore.PasswordProtection(keystorePassword.toCharArray()));

Revised code:
public SSLContext toSSLContext() throws GeneralSecurityException, IOException {
        
        Logger log = Logger.getLogger("io.quarkus.configuration.ssl");
        final Optional<Path> certFile = certificate.file;
        final Optional<Path> keyFile = certificate.keyFile;
        final Optional<Path> keyStoreFile = certificate.keyStoreFile;
        final String keystorePassword = certificate.keyStorePassword;
        final KeyStore keyStore;
        if (certFile.isPresent() && keyFile.isPresent()) {
            keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
            keyStore.load(null, keystorePassword.toCharArray());
            final Path certPath = certFile.get();
            final Iterator<PemEntry<?>> certItr = Pem.parsePemContent(load(certPath));
            final ArrayList<X509Certificate> certList = new ArrayList<>();
            while (certItr.hasNext()) {
                final PemEntry<?> item = certItr.next();
                final X509Certificate cert = item.tryCast(X509Certificate.class);
                if (cert != null) {
                    certList.add(cert);
                } else {
                    log.warnf("Ignoring non-certificate in certificate file \"%s\" (the type was %s)", certPath,
                            item.getEntry().getClass());
                }
            }
            if (certList.isEmpty()) {
                log.warnf("No certificate found in file \"%s\"", certPath);
            }
            final Path keyPath = keyFile.get();
            final Iterator<PemEntry<?>> keyItr = Pem.parsePemContent(load(keyPath));
            final PrivateKey privateKey;
            for (;;) {
                if (!keyItr.hasNext()) {
                    log.warnf("No key found in file \"%s\"", keyPath);
                    return null;
                }
                final PemEntry<?> next = keyItr.next();
                final PrivateKey entryKey = next.tryCast(PrivateKey.class);
                if (entryKey != null) {
                    privateKey = entryKey;
                    break;
                }
                log.warnf("Ignoring non-key in key file \"%s\" (the type was %s)", keyPath, next.getEntry().getClass());
            }
            if (keyItr.hasNext()) {
                log.warnf("Ignoring extra content in key file \"%s\"", keyPath);
            }
            
            keyStore.setEntry("default", new KeyStore.PrivateKeyEntry(privateKey, certList.toArray(new X509Certificate[0])),
                    new KeyStore.PasswordProtection(keystorePassword.toCharArray()));
        } else if (keyStoreFile.isPresent()) {
            final Path keyStorePath = keyStoreFile.get();
            final Optional<String> keyStoreFileType = certificate.keyStoreFileType;
            final String type;
            if (keyStoreFileType.isPresent()) {
                type = keyStoreFileType.get();
            } else {
                final String pathName = keyStorePath.toString();
                if (pathName.endsWith(".jks")) {
                    type = "jks";
                } else if (pathName.endsWith(".jceks")) {
                    type = "jceks";
                } else if (pathName.endsWith(".p12") || pathName.endsWith(".pkcs12") || pathName.endsWith(".pfx")) {
                    type = "pkcs12";
                } else {
                    
                    type = "jks";
                }
            }
            keyStore = KeyStore.getInstance(type);

            final InputStream keystoreAsResource = this.getClass().getClassLoader()
                    .getResourceAsStream(keyStorePath.toString());

            if (keystoreAsResource != null) {
                try (InputStream is = keystoreAsResource) {
                    keyStore.load(is, null);
                }
            } else {
                try (InputStream is = Files.newInputStream(keyStorePath)) {
                    keyStore.load(is, null);
                }
            }

        } else {
            return null;
        }
        final KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        keyManagerFactory.init(keyStore, keystorePassword.toCharArray());
        final SSLContextBuilder sslContextBuilder = new SSLContextBuilder();
        sslContextBuilder.setCipherSuiteSelector(cipherSuites.orElse(CipherSuiteSelector.openSslDefault()));
        ProtocolSelector protocolSelector;
        if (protocols.isEmpty()) {
            protocolSelector = ProtocolSelector.defaultProtocols();
        } else {
            protocolSelector = ProtocolSelector.empty().add(protocols.toArray(new Protocol[0]));
        }
        sslContextBuilder.setProtocolSelector(protocolSelector);
        sslContextBuilder.setKeyManager((X509ExtendedKeyManager) keyManagerFactory.getKeyManagers()[0]);
        if (sessionCacheSize.isPresent()) {
            sslContextBuilder.setSessionCacheSize(sessionCacheSize.getAsInt());
        }
        if (sessionTimeout.isPresent()) {
            sslContextBuilder.setSessionTimeout((int) min(Integer.MAX_VALUE, sessionTimeout.get().getSeconds()));
        }
        if (providerName.isPresent()) {
            sslContextBuilder.setProviderName(providerName.get());
        }
        return sslContextBuilder.build().create();
    }