{"record":{"id":"32911221da472ba7","repo":"eclipse-vertx/vert.x","slug":"pqc-enforcement-policy-pqcpolicy-requires-pq-co-329112","errorCode":null,"errorMessage":"PQC enforcement policy ${pqcPolicy} requires PQ compliant named groups but neither JDK nor OpenSSL support it","messagePattern":"PQC enforcement policy (.+?) requires PQ compliant named groups but neither JDK nor OpenSSL support it","errorType":"exception","errorClass":"VertxException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/internal/tls/SslContextManager.java","lineNumber":110,"sourceCode":"        boolean pqcSupported;\n        if (engineOptions instanceof JdkSSLEngineOptions) {\n          pqcSupported = JdkSSLEngineOptions.isPqcAvailable();\n        } else {\n          pqcSupported = OpenSSLEngineOptions.isPqcAvailable();\n        }\n        if (!pqcSupported) {\n          throw new VertxException(\"PQC enforcement policy \" + pqcPolicy + \" requires PQ compliant named groups but the configured SSL engine does not support it\");\n        }\n      } else {\n        // the user didn't specify any SSL engine, we pick one for them\n        if (JdkSSLEngineOptions.isPqcAvailable()) {\n          log.debug(\"JdkSslEngine supports PQ compliant groups, it will be used for the application\");\n          engineOptions = new JdkSSLEngineOptions();\n        } else if (OpenSSLEngineOptions.isPqcAvailable()) {\n          log.debug(\"OpenSslEngine supports PQ compliant groups, it will be used for the application\");\n          engineOptions = new OpenSSLEngineOptions();\n        } else {\n          throw new VertxException(\"PQC enforcement policy \" + pqcPolicy + \" requires PQ compliant named groups but neither JDK nor OpenSSL support it\");\n        }\n      }\n    }\n    if (engineOptions == null) {\n      if (useAlpn) {\n        if (JdkSSLEngineOptions.isAlpnAvailable()) {\n          engineOptions = new JdkSSLEngineOptions();\n        } else if (OpenSSLEngineOptions.isAlpnAvailable()) {\n          engineOptions = new OpenSSLEngineOptions();\n        }\n      }\n    }\n    if (engineOptions == null) {\n      engineOptions = new JdkSSLEngineOptions();\n    } else if (engineOptions instanceof OpenSSLEngineOptions) {\n      if (!OpenSsl.isAvailable()) {\n        VertxException ex = new VertxException(\"OpenSSL is not available\");\n        Throwable cause = OpenSsl.unavailabilityCause();","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/internal/tls/SslContextManager.java#L92-L128","documentation":"resolveEngineOptions throws VertxException when a PQC enforcement policy is required but no SSL engine at all can provide PQ-compliant named groups — neither the JDK nor the OpenSSL provider exposes them. There is no engine Vert.x can pick.","triggerScenarios":"PQC enforcement policy set, no explicit sslEngineOptions, and both JdkSSLEngineOptions.isPqcAvailable() and OpenSSLEngineOptions.isPqcAvailable() return false.","commonSituations":"Older JDK (no ML-KEM/hybrid groups) combined with netty-tcnative lacking PQ support, running with a strict PQC security policy on the client/server options.","solutions":["Upgrade the JDK (24+ has ML-KEM hybrid named groups) to make JdkSSLEngineOptions.isPqcAvailable() true.","Add/upgrade netty-tcnative with an OpenSSL/BoringSSL that supports PQ groups.","Relax or disable the PQC enforcement policy if legacy key exchange is acceptable."],"exampleFix":"// before\nmvn dependency: mvn 1.5.x tcnative (no PQ)\n// after\n<dependency>io.netty:netty-tcnative-boringssl-static:2.0.70+</dependency> // and JDK 24+","handlingStrategy":"validation","validationCode":"if (pqcEnforced && !JdkSSLEngineOptions.isPqcAvailable() && !OpenSSLEngineOptions.isPqcAvailable()) {\n  throw new IllegalStateException(\"No TLS engine with PQ named groups available on this runtime\");\n}","typeGuard":null,"tryCatchPattern":"try { resolve(); } catch (VertxException e) { throw new IllegalStateException(\"PQC policy cannot be satisfied; upgrade JDK/OpenSSL\", e); }","preventionTips":["Pin JDK 24+ (or a PQ-capable OpenSSL) in Dockerfiles before enabling PQC policies","Add a startup capability check that fails fast with an actionable message","Document the PQC policy's runtime requirements"],"tags":["ssl","pqc","post-quantum","tls","environment"],"backgroundTag":"unsupported-platform","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}