{"record":{"id":"960e13a4db600119","repo":"quarkusio/quarkus","slug":"the-tls-configuration-name-java-net-ssl-is-reser","errorCode":null,"errorMessage":"The TLS configuration name <java-net-ssl> is reserved for providing access to default SunJSSE keystore; neither Quarkus extensions nor end users can adjust or override it","messagePattern":"The TLS configuration name <java-net-ssl> is reserved for providing access to default SunJSSE keystore; neither Quarkus extensions nor end users can adjust or override it","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/CertificateRecorder.java","lineNumber":83,"sourceCode":"        this.vertx = vertx.getValue();\n        // Verify the default config\n        if (runtimeConfig.getValue().defaultCertificateConfig().isPresent()) {\n            verifyCertificateConfig(runtimeConfig.getValue().defaultCertificateConfig().get(), vertx.getValue(),\n                    TlsConfig.DEFAULT_NAME);\n        }\n\n        var bucketNames = new HashSet<>(runtimeConfig.getValue().namedCertificateConfig().keySet());\n        bucketNames.addAll(providerBucketNames);\n\n        // Verify the named configs\n        for (String name : bucketNames) {\n            if (name.equals(TlsConfig.DEFAULT_NAME)) {\n                throw new IllegalArgumentException(\n                        \"The TLS configuration name \" + TlsConfig.DEFAULT_NAME\n                                + \" cannot be used explicitly in configuration or qualifiers\");\n            }\n            if (name.equals(TlsConfig.JAVA_NET_SSL_TLS_CONFIGURATION_NAME)) {\n                throw new IllegalArgumentException(\n                        \"The TLS configuration name \" + TlsConfig.JAVA_NET_SSL_TLS_CONFIGURATION_NAME\n                                + \" is reserved for providing access to default SunJSSE keystore; neither Quarkus extensions nor end users can adjust or override it\");\n            }\n            verifyCertificateConfig(runtimeConfig.getValue().namedCertificateConfig().get(name), vertx.getValue(), name);\n        }\n\n        shutdownContext.addShutdownTask(new Runnable() {\n            @Override\n            public void run() {\n                if (reloader != null) {\n                    reloader.close();\n                }\n            }\n        });\n    }\n\n    private void verifyCertificateConfig(TlsBucketConfig config, Vertx vertx, String name) {\n        final TlsConfiguration tlsConfig = verifyCertificateConfigInternal(config, vertx, name);","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/CertificateRecorder.java#L65-L101","documentation":"The name <java-net-ssl> is reserved by the TLS registry for the built-in configuration exposing the default SunJSSE (java.net.ssl) keystore. validateCertificates() rejects any user- or extension-supplied named certificate config with this name so the reserved configuration can never be adjusted or overridden. Thrown as IllegalArgumentException during startup validation.","triggerScenarios":"Defining quarkus.tls.key-store.\"<java-net-ssl>\".* (or trust-store) in configuration, or an extension registering a named TLS config bucket named <java-net-ssl>.","commonSituations":"Trying to customize the JDK default keystore through the TLS registry naming scheme; a typo or macro expansion producing the reserved key; migrating configs from older Quarkus where the name was not reserved.","solutions":["Rename the configuration block to a custom name (e.g. quarkus.tls.key-store.\"jdk-tls\".*)","If the goal is to tune the JDK default SSLContext, configure it via standard JSSE system properties instead of the TLS registry","Use unnamed quarkus.tls.* properties if the intent was to change the default Quarkus configuration"],"exampleFix":"// before\nquarkus.tls.key-store.\"<java-net-ssl>\".paths=tls/server.pem\n// after\nquarkus.tls.key-store.\"jdk-tls\".paths=tls/server.pem","handlingStrategy":"validation","validationCode":"Set<String> names = ConfigProvider.getConfig().getPropertyNames();\nif (names.stream().anyMatch(p -> p.startsWith(\"quarkus.tls.\") && p.contains(\"<java-net-ssl>\"))) {\n    throw new IllegalStateException(\"<java-net-ssl> is reserved; use a custom TLS config name\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    // application startup / config registration\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"reserved\")) {\n        log.error(\"Rename the TLS config; <java-net-ssl> cannot be overridden\", e);\n    } else { throw e; }\n}","preventionTips":["Treat <default> and <java-net-ssl> as reserved names in all TLS config keys","Tune the JDK default keystore via JSSE system properties, not the TLS registry","Add a startup config check that rejects reserved bucket names"],"tags":["quarkus","tls","configuration","startup"],"backgroundTag":"reserved-config-name","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}