{"record":{"id":"11e62d09141237ca","repo":"quarkusio/quarkus","slug":"failed-to-create-sslcontext","errorCode":null,"errorMessage":"Failed to create SSLContext","messagePattern":"Failed to create SSLContext","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcTlsSupport.java","lineNumber":88,"sourceCode":"\n        public boolean useTlsRegistry() {\n            return tlsConfig != null;\n        }\n\n        public TlsConfiguration getTlsConfig() {\n            return tlsConfig;\n        }\n\n        public boolean isGlobalTrustAll() {\n            return globalTrustAll;\n        }\n\n        public SSLContext getSslContext() {\n            if (useTlsRegistry()) {\n                try {\n                    return tlsConfig.createSSLContext();\n                } catch (Exception e) {\n                    throw new RuntimeException(\"Failed to create SSLContext\", e);\n                }\n            }\n            return null;\n        }\n\n        public boolean useTlsRegistryAndMtls() {\n            return useTlsRegistry() && tlsConfig.getKeyStoreOptions() != null;\n        }\n\n        public String getTlsConfigName() {\n            return tlsConfigName;\n        }\n    }\n}\n","sourceCodeStart":70,"sourceCodeEnd":103,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcTlsSupport.java#L70-L103","documentation":"OidcTlsSupport.getSslContext() delegates to the TLS registry (tlsConfig.createSSLContext()) and wraps any exception as 'Failed to create SSLContext'. It indicates the TLS registry could not build an SSLContext from the configured key store/trust store material for mTLS or secure OIDC connections.","triggerScenarios":"Calling getSslContext() when useTlsRegistry() is true and tlsConfig.createSSLContext() throws — e.g. invalid keystore path/password, unsupported key format, missing store files.","commonSituations":"Wrong quarkus.tls.key-store/trust-store credentials or file paths; PKCS12/JKS format mismatch; missing BouncyCastle for exotic formats; certificate expired.","solutions":["Check the 'Caused by' chain for the underlying TLS registry failure (missing/corrupt store, wrong password)","Verify quarkus.tls.* key-store and trust-store files exist and passwords/formats are correct","Test store loading independently with keytool/openssl","If not using the TLS registry, configure OIDC connection security via the classic oidc tls configuration instead"],"exampleFix":"// before\nquarkus.tls.key-store.path=/etc/certs/keystore.p12\nquarkus.tls.key-store.password=wrongpass\n// after\nquarkus.tls.key-store.path=/etc/certs/keystore.p12\nquarkus.tls.key-store.password=correct-secret\nquarkus.tls.key-store.type=PKCS12","handlingStrategy":"try-catch","validationCode":"// validate store files exist before startup\nfor (String p : List.of(keyStorePath, trustStorePath)) {\n    if (!Files.exists(Path.of(p))) throw new IllegalStateException(\"Missing TLS store: \" + p);\n}","typeGuard":null,"tryCatchPattern":"try {\n    SSLContext ctx = support.getSslContext();\n} catch (RuntimeException e) {\n    Throwable cause = e.getCause();\n    log.errorf(\"TLS registry failed to build SSLContext: %s\", cause == null ? e : cause.getMessage());\n    throw e;\n}","preventionTips":["Test keystore/truststore loading with keytool before deploying","Keep passwords in a secret manager, and validate formats (PKCS12 vs JKS)","Log the 'Caused by' of TLS failures for diagnosis"],"tags":["quarkus","oidc","tls","ssl"],"backgroundTag":"ssl-context-creation-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}