{"record":{"id":"709bddb1a260e1d7","repo":"quarkusio/quarkus","slug":"the-name-of-the-tls-configuration-to-register-cann-709bdd","errorCode":null,"errorMessage":"The name of the TLS configuration to register cannot be <default>","messagePattern":"The name of the TLS configuration to register cannot be <default>","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/CertificateRecorder.java","lineNumber":217,"sourceCode":"                return new VertxCertificateHolder(vertx, k, runtimeConfig.getValue().namedCertificateConfig().get(k), null, ts);\n            });\n            return Optional.ofNullable(result);\n        }\n        return Optional.ofNullable(certificates.get(name));\n    }\n\n    @Override\n    public Optional<TlsConfiguration> getDefault() {\n        return get(TlsConfig.DEFAULT_NAME);\n    }\n\n    @Override\n    public void register(String name, TlsConfiguration configuration) {\n        if (name == null) {\n            throw new IllegalArgumentException(\"The name of the TLS configuration to register cannot be null\");\n        }\n        if (name.equals(TlsConfig.DEFAULT_NAME)) {\n            throw new IllegalArgumentException(\"The name of the TLS configuration to register cannot be <default>\");\n        }\n        if (name.equals(TlsConfig.JAVA_NET_SSL_TLS_CONFIGURATION_NAME)) {\n            throw new IllegalArgumentException(\n                    \"The TLS configuration name \" + TlsConfig.JAVA_NET_SSL_TLS_CONFIGURATION_NAME\n                            + \" is reserved for providing access to default SunJSSE keystore; neither Quarkus extensions nor end users can adjust of override it\");\n        }\n        if (configuration == null) {\n            throw new IllegalArgumentException(\"The TLS configuration to register cannot be null\");\n        }\n        certificates.put(name, configuration);\n    }\n\n    public Supplier<TlsConfigurationRegistry> getSupplier() {\n        return new Supplier<TlsConfigurationRegistry>() {\n            @Override\n            public TlsConfigurationRegistry get() {\n                return CertificateRecorder.this;\n            }","sourceCodeStart":199,"sourceCodeEnd":235,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/CertificateRecorder.java#L199-L235","documentation":"register(name, configuration) cannot register a configuration under the reserved name <default>; the default TLS configuration is managed internally by the TLS registry. Attempting to replace it programmatically is rejected with IllegalArgumentException to keep the default configuration authoritative.","triggerScenarios":"Application or extension code calls tlsConfigurationRegistry.register(\"<default>\", configuration) or passes a name variable that evaluates to TlsConfig.DEFAULT_NAME.","commonSituations":"Trying to override the default TLS configuration at runtime; generic registration loops over config buckets that accidentally include the <default> key; copying registry names into re-registration calls.","solutions":["Register under a custom name (e.g. \"my-tls\") and reference that name where the configuration is consumed","To influence the default configuration, use the unnamed quarkus.tls.* config properties instead of programmatic registration","Filter out TlsConfig.DEFAULT_NAME before looping over configuration buckets to register"],"exampleFix":"// before\nregistry.register(\"<default>\", configuration);\n// after\nregistry.register(\"my-tls\", configuration);","handlingStrategy":"validation","validationCode":"if (TlsConfig.DEFAULT_NAME.equals(name)) {\n    throw new IllegalArgumentException(\"Use unnamed quarkus.tls.* config to change the default TLS configuration\");\n}","typeGuard":"static boolean isRegisterableTlsName(String name) {\n    return name != null && !TlsConfig.DEFAULT_NAME.equals(name)\n        && !TlsConfig.JAVA_NET_SSL_TLS_CONFIGURATION_NAME.equals(name);\n}","tryCatchPattern":"try {\n    registry.register(name, configuration);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"cannot be <default>\")) {\n        log.error(\"Register under a custom name; the default TLS config is managed by Quarkus\", e);\n    } else { throw e; }\n}","preventionTips":["Exclude TlsConfig.DEFAULT_NAME when looping over bucket names to register","Always register programmatic TLS configs under a unique custom name","Adjust the default configuration through quarkus.tls.* properties, not the registry API"],"tags":["quarkus","tls","api-misuse","reserved-name"],"backgroundTag":"reserved-config-name","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}