{"record":{"id":"821d022cfe2c6ae7","repo":"quarkusio/quarkus","slug":"could-not-find-jetty-npn-alpn-or-conscrypt-as-inst","errorCode":null,"errorMessage":"Could not find Jetty NPN/ALPN or Conscrypt as installed JDK providers","messagePattern":"Could not find Jetty NPN/ALPN or Conscrypt as installed JDK providers","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/grpc-common/runtime/src/main/java/io/quarkus/grpc/common/runtime/graal/GrpcNettySubstitutions.java","lineNumber":41,"sourceCode":"    @Substitute\n    static void logSslEngineDetails(Level level, ChannelHandlerContext ctx, String msg, Throwable t) {\n        Logger log = Logger.getLogger(\"io.grpc.netty.ProtocolNegotiators\");\n        if (log.isLoggable(level)) {\n            log.log(level, msg + \"\\nNo SSLEngine details available!\", t);\n        }\n    }\n}\n\n@TargetClass(className = \"io.grpc.netty.GrpcSslContexts\")\nfinal class Target_io_grpc_netty_GrpcSslContexts {\n\n    @Substitute\n    public static SslContextBuilder configure(SslContextBuilder builder, SslProvider provider) {\n        switch (provider) {\n            case JDK: {\n                Provider jdkProvider = findJdkProvider();\n                if (jdkProvider == null) {\n                    throw new IllegalArgumentException(\n                            \"Could not find Jetty NPN/ALPN or Conscrypt as installed JDK providers\");\n                }\n                return configure(builder, jdkProvider);\n            }\n            default:\n                throw new IllegalArgumentException(\"Unsupported provider: \" + provider);\n        }\n    }\n\n    @Alias\n    private static Provider findJdkProvider() {\n        return null;\n    }\n\n    @Alias\n    public static SslContextBuilder configure(SslContextBuilder builder, Provider jdkProvider) {\n        return null;\n    }","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/grpc-common/runtime/src/main/java/io/quarkus/grpc/common/runtime/graal/GrpcNettySubstitutions.java#L23-L59","documentation":"This is a GraalVM native-image substitution for Netty's GrpcSslContexts.configure. In native mode Netty's JDK-provider lookup cannot find Jetty NPN/ALPN or Conscrypt, so the substituted findJdkProvider returns null and the code throws IllegalArgumentException. TLS over gRPC with SslProvider.JDK cannot be set up in the native image.","triggerScenarios":"Building/running a native-image application that uses gRPC over TLS with the JDK SSL provider, when neither Conscrypt nor Jetty ALPN is available as a JDK provider in the image.","commonSituations":"Native build of a TLS-enabled gRPC client/server without adding Conscrypt; upgrading to native image where JDK ALPN bootclasspath hooks no longer exist.","solutions":["Add Conscrypt as a dependency and register it for reflection/native so it is found as a JDK provider","Configure gRPC TLS to use the OpenSSL provider instead of JDK","Avoid the Netty gRPC JDK SSL path in native mode (e.g. use Quarkus-managed TLS config)"],"exampleFix":"// before\nGrpcSslContexts.forClient().trustManager(ca).build(); // defaults to JDK provider in native\n// after\nGrpcSslContexts.configure(GrpcSslContexts.forClient().trustManager(ca),\n        SslProvider.OPENSSL).build();","handlingStrategy":"fallback","validationCode":"Provider p = Security.getProvider(\"Conscrypt\");\nif (p == null && isNativeImage()) {\n    LOG.warn(\"No ALPN/Conscrypt JDK provider; use OpenSSL provider for native TLS\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    GrpcSslContexts.configure(builder, SslProvider.JDK);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"Jetty NPN/ALPN\")) {\n        return GrpcSslContexts.configure(builder, SslProvider.OPENSSL);\n    }\n    throw e;\n}","preventionTips":["Add Conscrypt dependency for native TLS","Test TLS gRPC in native mode, not only JVM mode","Prefer Quarkus-managed TLS config over manual Netty SSL setup"],"tags":["grpc","netty","native-image","tls","graalvm"],"backgroundTag":"missing-native-image-provider","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}