{"record":{"id":"86a9daa43647e870","repo":"quarkusio/quarkus","slug":"trust-options-have-already-been-set","errorCode":null,"errorMessage":"Trust options have already been set","messagePattern":"Trust options have already been set","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/grpc/runtime/src/main/java/io/quarkus/grpc/runtime/supports/SSLConfigHelper.java","lineNumber":72,"sourceCode":"            ensureTrustOptionsNotSet(options);\n            options.setTrustOptions(toPfxOptions(configuration));\n        }\n    }\n\n    private static PfxOptions toPfxOptions(GrpcClientConfiguration.TlsClientConfig.PfxConfiguration configuration) {\n        PfxOptions pfxOptions = new PfxOptions();\n        if (configuration.path().isPresent()) {\n            pfxOptions.setPath(configuration.path().get());\n        }\n        if (configuration.password().isPresent()) {\n            pfxOptions.setPassword(configuration.password().get());\n        }\n        return pfxOptions;\n    }\n\n    private static void ensureTrustOptionsNotSet(TCPSSLOptions options) {\n        if (options.getTrustOptions() != null) {\n            throw new IllegalArgumentException(\"Trust options have already been set\");\n        }\n    }\n\n    public static void configurePemKeyCertOptions(TCPSSLOptions options,\n            GrpcClientConfiguration.TlsClientConfig.PemKeyCertConfiguration configuration) {\n        if (configuration.certs().isPresent() && !configuration.certs().get().isEmpty() && configuration.keys().isPresent()\n                && !configuration.keys().get().isEmpty()) {\n            ensureKeyCertOptionsNotSet(options);\n            options.setKeyCertOptions(toPemKeyCertOptions(configuration));\n        }\n    }\n\n    private static KeyCertOptions toPemKeyCertOptions(\n            GrpcClientConfiguration.TlsClientConfig.PemKeyCertConfiguration configuration) {\n        PemKeyCertOptions pemKeyCertOptions = new PemKeyCertOptions();\n        if (configuration.certs().isPresent()) {\n            for (String cert : configuration.certs().get()) {\n                pemKeyCertOptions.addCertPath(cert);","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/grpc/runtime/src/main/java/io/quarkus/grpc/runtime/supports/SSLConfigHelper.java#L54-L90","documentation":"SSLConfigHelper.configureXxxTrustOptions methods copy PEM/JKS/PFX trust material into Vert.x TCPSSLOptions. To prevent silently overwriting trust configuration, each first calls ensureTrustOptionsNotSet, which throws IllegalArgumentException if trustOptions were already configured on the same options object.","triggerScenarios":"Configuring more than one trust source (e.g. both quarkus.grpc.clients.<name>.tls.trust-certificate-pem-files and trust-certificate-jks) on the same client/server TLS config; calling configurePemTrustOptions then configureJksTrustOptions on the same TCPSSLOptions instance.","commonSituations":"Mixing PEM and JKS trust store settings in application.properties; programmatically setting trust options then applying config-based ones; merging TLS configs from two sources.","solutions":["Remove all but one trust-options configuration source for the client/server","Decide on a single trust store format (PEM, JKS, or PFX) and keep only that","If combining is intended, merge material into one store instead of setting options twice"],"exampleFix":"// before\nquarkus.grpc.clients.hello.tls.trust-certificate-pem-files=ca.pem\nquarkus.grpc.clients.hello.tls.trust-certificate-jks=truststore.jks\n// after\nquarkus.grpc.clients.hello.tls.trust-certificate-pem-files=ca.pem","handlingStrategy":"validation","validationCode":"if (options.getTrustOptions() != null) {\n    throw new IllegalArgumentException(\"Choose one trust source: PEM, JKS or PFX\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    SSLConfigHelper.configureJksTrustOptions(options, cfg);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"Trust options\")) {\n        LOG.error(\"Multiple trust sources configured for the same client/server\");\n    }\n    throw e;\n}","preventionTips":["Configure exactly one trust store format per client/server","Audit tls.* properties for duplicates","Merge certificates into a single store when multiple CAs are needed"],"tags":["grpc","tls","configuration","ssl","quarkus"],"backgroundTag":"duplicate-ssl-configuration","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}