{"record":{"id":"0f7c2f0ac59a1a40","repo":"quarkusio/quarkus","slug":"failed-to-create-keycloak-admin-client-sslcontext","errorCode":null,"errorMessage":"Failed to create Keycloak Admin client SSLContext","messagePattern":"Failed to create Keycloak Admin client SSLContext","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"extensions/keycloak-admin-resteasy-client/runtime/src/main/java/io/quarkus/keycloak/admin/resteasy/client/runtime/KeycloakAdminResteasyClientRecorder.java","lineNumber":105,"sourceCode":"            @Override\n            public Client newRestEasyClient(Object customJacksonProvider, SSLContext sslContext, boolean disableTrustManager) {\n                // this is what 'org.keycloak.admin.client.ClientBuilderWrapper.create' does\n                var builder = new ResteasyClientBuilderImpl();\n                builder.connectionPoolSize(10);\n\n                if (namedTlsConfig == null) {\n                    builder.sslContext(sslContext);\n                    if (globalTrustAll) {\n                        builder.disableTrustManager();\n                    }\n                } else {\n                    if (namedTlsConfig.isTrustAll()) {\n                        builder.disableTrustManager();\n                    }\n                    try {\n                        builder.sslContext(namedTlsConfig.createSSLContext());\n                    } catch (Exception e) {\n                        throw new RuntimeException(\"Failed to create Keycloak Admin client SSLContext\", e);\n                    }\n                }\n\n                // this ensures we don't customize managed (shared) ObjectMapper available in the CDI container\n                // and that we use QuarkusJacksonSerializer that works in native mode\n                builder.register(new AppJsonQuarkusJacksonSerializer(), 100);\n\n                return builder.build();\n            }\n\n            @Override\n            public <R> R targetProxy(WebTarget webTarget, Class<R> aClass) {\n                return (ResteasyWebTarget.class.cast(webTarget)).proxy(aClass);\n            }\n        });\n    }\n\n    public void avoidRuntimeInitIssueInClientBuilderWrapper() {","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/keycloak-admin-resteasy-client/runtime/src/main/java/io/quarkus/keycloak/admin/resteasy/client/runtime/KeycloakAdminResteasyClientRecorder.java#L87-L123","documentation":"When Quarkus builds the internal Keycloak Admin REST client at startup, it configures TLS from the named TLS registry configuration (truststore, keystore, trust-all). If namedTlsConfig.createSSLContext() throws for any reason, the recorder wraps it in a RuntimeException 'Failed to create Keycloak Admin client SSLContext', aborting application startup. It means the TLS configuration for the admin client is invalid.","triggerScenarios":"A quarkus.keycloak.admin-client.tls configuration referencing a truststore/keystore file that doesn't exist, has a wrong password, or an unsupported format; an invalid TLS configuration key; or an underlying KeyStore/SSLContext initialization exception.","commonSituations":"Path typos or non-mounted secrets in containerized/native deployments; wrong keystore type (PKCS12 vs JKS) or password after rotating credentials; misconfigured quarkus.tls.* named config used by the admin client.","solutions":["Verify the keystore/truststore paths, passwords, and types in the quarkus.keycloak.admin-client.tls (or named TLS registry) config; check the cause chain for the exact KeyStoreException","If no custom TLS is needed, remove the tls configuration so defaults are used, or set trust-all=true for dev/test","Ensure the certificate files are packaged/available at runtime (e.g. in the container image) with correct permissions","Validate certificates are not expired and the format matches the configured type"],"exampleFix":"// before\nquarkus.keycloak.admin-client.tls.trust-store-file=/secrets/wrong.p12\n// after\nquarkus.keycloak.admin-client.tls.trust-store-file=/secrets/truststore.p12\nquarkus.keycloak.admin-client.tls.trust-store-password=secret\nquarkus.keycloak.admin-client.tls.trust-store-type=PKCS12","handlingStrategy":"try-catch","validationCode":"// Validate TLS config files before startup:\nString tsPath = config.getValue(\"quarkus.keycloak.admin-client.tls.trust-store-file\");\nString tsPass = config.getValue(\"quarkus.keycloak.admin-client.tls.trust-store-password\");\nString tsType = config.getValue(\"quarkus.keycloak.admin-client.tls.trust-store-type\");\ntry (InputStream in = new FileInputStream(tsPath)) {\n    KeyStore.getInstance(tsType != null ? tsType : \"PKCS12\").load(in, tsPass.toCharArray());\n} catch (Exception e) {\n    throw new IllegalStateException(\"Invalid truststore for Keycloak admin client\", e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    Keycloak keycloak = keycloakAdminClientCreator.create(); // startup phase\n} catch (RuntimeException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"Failed to create Keycloak Admin client SSLContext\")) {\n        log.errorf(e.getCause(), \"Check keystore/truststore path, password, and type in quarkus.keycloak.admin-client.tls.*\");\n    }\n    throw e;\n}","preventionTips":["Verify keystore/truststore paths exist and are packaged into the container/native image","Confirm store type (PKCS12/JKS) matches the actual file format and passwords are current","Log e.getCause() to pinpoint KeyStoreException vs certificate expiry vs path issues","Use trust-all only in dev/test; keep a validated truststore for production"],"tags":["keycloak","tls","ssl","startup","configuration"],"backgroundTag":"ssl-context-creation-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}