{"record":{"id":"4c7c3116174301a4","repo":"apache/pulsar","slug":"no-java-security-provider-named-name-could-be","errorCode":null,"errorMessage":"No java.security.Provider named '${name}' could be resolved via Security.getProvider(...) or via ServiceLoader (META-INF/services/java.security.Provider) on the application class loader. Ensure the provider is on the classpath and registered — a JSSE (SSLContext) provider such as BCJSSE for jsseProvider (which additionally requires the bctls jar on the classpath), or a JCA (KeyStore/CertificateFactory) provider such as BCFIPS for jcaProvider.","messagePattern":"No java\\.security\\.Provider named '(.+?)' could be resolved via Security\\.getProvider\\(\\.\\.\\.\\) or via ServiceLoader \\(META-INF/services/java\\.security\\.Provider\\) on the application class loader\\. Ensure the provider is on the classpath and registered — a JSSE \\(SSLContext\\) provider such as BCJSSE for jsseProvider \\(which additionally requires the bctls jar on the classpath\\), or a JCA \\(KeyStore/CertificateFactory\\) provider such as BCFIPS for jcaProvider\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pulsar-common/src/main/java/org/apache/pulsar/common/util/tls/JcaProviders.java","lineNumber":433,"sourceCode":"                                + \"named JCA provider\");\n                continue;\n            }\n            if (name.equals(provider.getName())) {\n                log.debug().attr(\"provider\", name).log(\"Resolved JCA provider via ServiceLoader\");\n                return provider;\n            }\n        }\n        // 3. BouncyCastle's JSSE provider is invisible to both steps above until someone registers it —\n        // bctls ships no services entry — so register it from the classpath on demand when it is the name\n        // being pinned. See bouncyCastleJsseProvider() for why it cannot just be default-constructed.\n        if (BC_JSSE.equals(name)) {\n            Optional<ResolvedBouncyCastleProvider> jsse = bouncyCastleJsseProvider();\n            if (jsse.isPresent()) {\n                return jsse.get().provider();\n            }\n        }\n        // 4. Fail loudly — a misconfigured provider must not silently default.\n        throw new IllegalArgumentException(\"No java.security.Provider named '\" + name + \"' could be resolved via \"\n                + \"Security.getProvider(...) or via ServiceLoader (META-INF/services/java.security.Provider) on the \"\n                + \"application class loader. Ensure the provider is on the classpath and registered — a JSSE \"\n                + \"(SSLContext) provider such as BCJSSE for jsseProvider (which additionally requires the bctls jar \"\n                + \"on the classpath), or a JCA (KeyStore/CertificateFactory) \"\n                + \"provider such as BCFIPS for jcaProvider.\");\n    }\n\n    /**\n     * Resolve a security {@link Provider} by name, falling back to the default {@code TLS}\n     * {@code SSLContext} provider when the name is blank or unknown.\n     */\n    static Provider resolveProvider(String providerName) throws NoSuchAlgorithmException {\n        Provider provider = null;\n        if (!StringUtils.isEmpty(providerName)) {\n            provider = Security.getProvider(providerName);\n        }\n\n        if (provider == null) {","sourceCodeStart":415,"sourceCodeEnd":451,"githubUrl":"https://github.com/apache/pulsar/blob/820761864ed8e2a7d2e52dd9763ad2ae117c1395/pulsar-common/src/main/java/org/apache/pulsar/common/util/tls/JcaProviders.java#L415-L451","documentation":"JcaProviders.resolveNamedProvider(name) resolves a named java.security.Provider first via Security.getProvider(name), then via ServiceLoader on META-INF/services/java.security.Provider, and finally via known BouncyCastle aliases. If nothing resolves, it throws IllegalArgumentException — a misconfigured provider must fail loudly rather than silently falling back to the default.","triggerScenarios":"Configuring a provider name (e.g. jsseProvider=BCJSSE or jcaProvider=BCFIPS) when: the jar is not on the classpath; the provider was never registered via Security.addProvider / security properties; the name is misspelled; or for BCJSSE the bctls jar is missing so the SSLContext provider cannot be found.","commonSituations":"FIPS-mode broker/client startup with tls provider settings pointing at BouncyCastle that isn't packaged; typos in provider names in pulsar config files; fat-jar shading dropping META-INF/services entries.","solutions":["Add the provider jar to the classpath (bc-fips for BCFIPS; bcpkix/bctls for BCJSSE)","Register it programmatically with Security.addProvider(new BouncyCastleFipsProvider()) or in java.security config","Correct the provider name spelling in the configuration to match Provider.getName()","Verify ServiceLoader entries survive shading/build repackaging"],"exampleFix":"// before (config)\ntlsJsseProviderName=BCJSSE   // bctls jar missing\n// after\n// add bctls + bc-fips jars to classpath, then:\nSecurity.addProvider(new org.bouncycastle.jsse.provider.BouncyCastleJsseProvider());\ntlsJsseProviderName=BCJSSE","handlingStrategy":"validation","validationCode":"String name = \"BCFIPS\";\nProvider p = Security.getProvider(name);\nif (p == null) {\n    p = ServiceLoader.load(java.security.Provider.class).stream()\n        .map(Provider::getName).filter(name::equals).findFirst().orElse(null);\n}\nif (p == null) throw new IllegalStateException(\"Provider \" + name + \" not on classpath/registered\");","typeGuard":"java.util.Optional<Provider> findProvider(String name) { Provider p = Security.getProvider(name); return p != null ? java.util.Optional.of(p) : ServiceLoader.load(java.security.Provider.class).stream().filter(x -> x.getName().equals(name)).findFirst(); }","tryCatchPattern":"try { Provider p = JcaProviders.resolveNamedProvider(name); } catch (IllegalArgumentException e) { log.error(\"TLS provider '{}' unresolved — check classpath and Security.addProvider: {}\", name, e.getMessage()); throw e; }","preventionTips":["Add the provider jars (bc-fips, bcpkix-fips, bctls-fips) to the runtime classpath","Register providers in java.security config or Security.addProvider at startup","Verify shaded/fat jars retain META-INF/services/java.security.Provider entries","Fail fast with a startup self-check that resolves all configured provider names","Match configured names exactly to Provider.getName() (e.g. 'BCFIPS', 'BCJSSE')"],"tags":["java","tls","security-provider","classpath","configuration"],"backgroundTag":"security-provider-not-found","analyzedSha":"820761864ed8e2a7d2e52dd9763ad2ae117c1395","analyzedAt":"2026-09-06T00:14:20.138Z","contentChangedAt":"2026-09-06T00:14:20.138Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}