{"record":{"id":"03d9b72a25f1f0a0","repo":"quarkusio/quarkus","slug":"the-tls-configuration-name-java-net-ssl-is-reser-03d9b7","errorCode":null,"errorMessage":"The TLS configuration name <java-net-ssl> is reserved for providing access to default SunJSSE keystore; neither Quarkus extensions nor end users can adjust of override it","messagePattern":"The TLS configuration name <java-net-ssl> is reserved for providing access to default SunJSSE keystore; neither Quarkus extensions nor end users can adjust of override it","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/CertificateRecorder.java","lineNumber":220,"sourceCode":"        }\n        return Optional.ofNullable(certificates.get(name));\n    }\n\n    @Override\n    public Optional<TlsConfiguration> getDefault() {\n        return get(TlsConfig.DEFAULT_NAME);\n    }\n\n    @Override\n    public void register(String name, TlsConfiguration configuration) {\n        if (name == null) {\n            throw new IllegalArgumentException(\"The name of the TLS configuration to register cannot be null\");\n        }\n        if (name.equals(TlsConfig.DEFAULT_NAME)) {\n            throw new IllegalArgumentException(\"The name of the TLS configuration to register cannot be <default>\");\n        }\n        if (name.equals(TlsConfig.JAVA_NET_SSL_TLS_CONFIGURATION_NAME)) {\n            throw new IllegalArgumentException(\n                    \"The TLS configuration name \" + TlsConfig.JAVA_NET_SSL_TLS_CONFIGURATION_NAME\n                            + \" is reserved for providing access to default SunJSSE keystore; neither Quarkus extensions nor end users can adjust of override it\");\n        }\n        if (configuration == null) {\n            throw new IllegalArgumentException(\"The TLS configuration to register cannot be null\");\n        }\n        certificates.put(name, configuration);\n    }\n\n    public Supplier<TlsConfigurationRegistry> getSupplier() {\n        return new Supplier<TlsConfigurationRegistry>() {\n            @Override\n            public TlsConfigurationRegistry get() {\n                return CertificateRecorder.this;\n            }\n        };\n    }\n","sourceCodeStart":202,"sourceCodeEnd":238,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/CertificateRecorder.java#L202-L238","documentation":"Quarkus's TLS registry reserves the configuration name '<java-net-ssl>' for the built-in configuration that exposes the default SunJSSE keystore (the JVM-wide default used by java.net clients). Registering a custom TlsConfiguration under this name would silently override JVM default SSL behavior, so CertificateRecorder.register throws IllegalArgumentException to prevent it.","triggerScenarios":"Calling TlsConfigurationRegistry/Building register(name, configuration) (directly or via a custom extension recorder) with name equal to TlsConfig.JAVA_NET_SSL_TLS_CONFIGURATION_NAME, i.e. '<java-net-ssl>'.","commonSituations":"Writing a custom extension that contributes a TLS configuration and using a constant or user-supplied name that resolves to '<java-net-ssl>'; copying sample code that registers the java-net-ssl configuration; end users trying to override the default JVM keystore through the registry.","solutions":["Rename your TLS configuration to something other than '<java-net-ssl>' (e.g. 'my-app-ssl') and reference that name from your client/server config (tls.configuration-name / tls.*-tls-configuration-name).","To customize the JVM default, configure the JDK keystore via -Djavax.net.ssl.keyStore/-Djavax.net.ssl.trustStore or quarkus.tls.key-store/-trust-store default settings instead of registering '<java-net-ssl>'.","If you need to access the SunJSSE default configuration, look it up via the registry rather than trying to register/replace it."],"exampleFix":"// before\nregistry.register(\"<java-net-ssl>\", myConfig);\n// after\nregistry.register(\"my-app-ssl\", myConfig);","handlingStrategy":"validation","validationCode":"if (TlsConfig.JAVA_NET_SSL_TLS_CONFIGURATION_NAME.equals(name)) {\n    throw new IllegalArgumentException(\"'<java-net-ssl>' is reserved; choose a custom name\");\n}\nTlsConfigurationRegistry registry = ...;\nif (registry.get(name) != null) { /* decide whether overwrite is intended */ }","typeGuard":"boolean isReservedName(String name) {\n    return TlsConfig.DEFAULT_NAME.equals(name) || TlsConfig.JAVA_NET_SSL_TLS_CONFIGURATION_NAME.equals(name);\n}","tryCatchPattern":"try {\n    recorder.register(name, config);\n} catch (IllegalArgumentException e) {\n    log.errorf(\"Cannot register TLS config '%s': %s\", name, e.getMessage());\n}","preventionTips":["Never hard-code '<java-net-ssl>' or '<default>' as a registration name; use constants from TlsConfig only to read, never to register.","Give custom TLS configurations descriptive app-specific names.","Customize the JVM default via javax.net.ssl system properties, not the registry."],"tags":["tls","quarkus","illegal-argument","reserved-name"],"backgroundTag":"reserved-name-override","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}