{"record":{"id":"4442d2d2b1db15b4","repo":"quarkusio/quarkus","slug":"could-not-configure-mongodb-client-with-tls-regist","errorCode":null,"errorMessage":"Could not configure MongoDB client with TLS registry","messagePattern":"Could not configure MongoDB client with TLS registry","errorType":"exception","errorClass":"MongoConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/mongodb-client/runtime/src/main/java/io/quarkus/mongodb/runtime/MongoClients.java","lineNumber":275,"sourceCode":"            this.tlsConfigurationRegistry = tlsConfigurationRegistry;\n        }\n\n        @Override\n        public void apply(SslSettings.Builder builder) {\n            builder.enabled(!disableSslSupport);\n            if (!disableSslSupport) {\n                Optional<TlsConfiguration> tlsConfig = TlsConfiguration.from(tlsConfigurationRegistry,\n                        config.tlsConfigurationName());\n                if (tlsConfig.isPresent()) {\n                    // Honor the hostname verification configured at the TLS registry level.\n                    // \"NONE\" disables hostname verification, which maps to allowing invalid host names.\n                    boolean insecure = tlsConfig.get().getHostnameVerificationAlgorithm()\n                            .map(\"NONE\"::equals).orElse(false);\n                    builder.invalidHostNameAllowed(insecure);\n                    try {\n                        builder.context(tlsConfig.get().createSSLContext());\n                    } catch (Exception e) {\n                        throw new MongoConfigurationException(\"Could not configure MongoDB client with TLS registry\", e);\n                    }\n                } else {\n                    builder.invalidHostNameAllowed(false);\n                }\n            }\n        }\n    }\n\n    private static class SocketSettingsBuilder implements Block<SocketSettings.Builder> {\n        public SocketSettingsBuilder(MongoClientConfig config) {\n            this.config = config;\n        }\n\n        private final MongoClientConfig config;\n\n        @Override\n        public void apply(SocketSettings.Builder builder) {\n            if (config.connectTimeout().isPresent()) {","sourceCodeStart":257,"sourceCodeEnd":293,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/mongodb-client/runtime/src/main/java/io/quarkus/mongodb/runtime/MongoClients.java#L257-L293","documentation":"When a TLS registry is configured for the MongoDB client, Quarkus builds an SSLContext from it via tlsConfig.createSSLContext(). If that construction throws, the failure is wrapped in a MongoConfigurationException with this message.","triggerScenarios":"Applying MongoClientSettings where a TLS/keystore config is present and `createSSLContext()` throws — e.g. keystore file missing/unreadable, wrong password, unsupported keystore type, or invalid truststore configuration.","commonSituations":"Keystore path typo or file not packaged in container; keystore password changed in secrets without updating config; using a JKS keystore with an algorithm not available in the runtime (e.g. native image missing provider); hostname verification + TLS registry misconfiguration.","solutions":["Check the wrapped cause `e` in the exception stack trace — it names the real keystore/SSL failure","Verify keystore/truststore file paths exist at runtime and are readable (include them in the container image)","Confirm keystore type and password match (`quarkus.mongodb.tls-configuration-name` and the referenced quarkus.tls.* config)","Test the TLS registry config with another component to isolate whether the problem is the registry or the Mongo wiring"],"exampleFix":"// before\nquarkus.mongodb.tls-configuration-name=mongo-tls\nquarkus.tls.mongo-tls.key-store.p12.path=/etc/certs/wrong.p12\n// after\nquarkus.mongodb.tls-configuration-name=mongo-tls\nquarkus.tls.mongo-tls.key-store.p12.path=/etc/certs/server.p12\nquarkus.tls.mongo-tls.key-store.p12.password=${KEYSTORE_PASSWORD}","handlingStrategy":"validation","validationCode":"// Verify the keystore is loadable before startup\ntry (var in = new FileInputStream(tlsKeystorePath)) {\n    KeyStore.getInstance(tlsKeystoreType).load(in, password.toCharArray());\n} catch (Exception e) {\n    throw new IllegalStateException(\"TLS keystore invalid: \" + e.getMessage(), e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    mongoClient = mongoClients.create(name);\n} catch (MongoConfigurationException e) {\n    throw new StartupException(\"Mongo TLS setup failed, check TLS registry config\", e.getCause());\n}","preventionTips":["Mount certificates into the container image and verify paths exist at startup","Keep keystore passwords in config expressions bound to environment secrets","Test the TLS registry config with a health check before wiring it to Mongo"],"tags":["mongodb","tls","ssl","configuration"],"backgroundTag":"ssl-context-creation-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}