{"record":{"id":"982b3068a7a84a9d","repo":"quarkusio/quarkus","slug":"quarkus-datasource-reactive-hostname-verification-982b30","errorCode":null,"errorMessage":"quarkus.datasource.reactive.hostname-verification-algorithm must be specified under verify-full sslmode","messagePattern":"quarkus\\.datasource\\.reactive\\.hostname-verification-algorithm must be specified under verify-full sslmode","errorType":"exception","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/reactive-pg-client/runtime/src/main/java/io/quarkus/reactive/pg/client/runtime/PgPoolRecorder.java","lineNumber":124,"sourceCode":"            pgConnectOptionsList.add(new PgConnectOptions());\n        }\n\n        pgConnectOptionsList.forEach(pgConnectOptions -> {\n            ReactivePoolUtil.configureCredentials(pgConnectOptions, dataSourceRuntimeConfig);\n\n            ReactivePoolUtil.configurePreparedStatementCache(pgConnectOptions, dataSourceReactiveRuntimeConfig);\n\n            if (dataSourceReactivePostgreSQLConfig.pipeliningLimit().isPresent()) {\n                pgConnectOptions.setPipeliningLimit(dataSourceReactivePostgreSQLConfig.pipeliningLimit().getAsInt());\n            }\n\n            if (dataSourceReactivePostgreSQLConfig.sslMode().isPresent()) {\n                final SslMode sslMode = dataSourceReactivePostgreSQLConfig.sslMode().get();\n                pgConnectOptions.setSslMode(sslMode);\n\n                var algo = dataSourceReactiveRuntimeConfig.hostnameVerificationAlgorithm();\n                if (\"NONE\".equalsIgnoreCase(algo) && sslMode == SslMode.VERIFY_FULL) {\n                    throw new IllegalArgumentException(\n                            \"quarkus.datasource.reactive.hostname-verification-algorithm must be specified under verify-full sslmode\");\n                }\n            } else if (dataSourceReactiveRuntimeConfig.tlsConfigurationName().isPresent()) {\n                // Auto-enable SSL mode when a named TLS configuration is set\n                pgConnectOptions.setSslMode(SslMode.REQUIRE);\n            }\n\n            if (dataSourceReactivePostgreSQLConfig.sslNegotiation().isPresent()) {\n                pgConnectOptions.setSslNegotiation(dataSourceReactivePostgreSQLConfig.sslNegotiation().get());\n            }\n\n            pgConnectOptions.setUseLayer7Proxy(dataSourceReactivePostgreSQLConfig.useLayer7Proxy());\n\n            ReactivePoolUtil.configureSsl(pgConnectOptions, dataSourceReactiveRuntimeConfig, tlsRegistry);\n\n            dataSourceReactiveRuntimeConfig.additionalProperties().forEach(pgConnectOptions::addProperty);\n\n            // Use the convention defined by Quarkus Micrometer Vert.x metrics to create metrics prefixed with postgresql.","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/reactive-pg-client/runtime/src/main/java/io/quarkus/reactive/pg/client/runtime/PgPoolRecorder.java#L106-L142","documentation":"PgPoolRecorder.toPgConnectOptions validates that hostname verification is performed when ssl-mode=verify-full. PostgreSQL's SslMode.VERIFY_FULL requires a hostname verification algorithm; if quarkus.datasource.reactive.hostname-verification-algorithm is NONE, the recorder throws IllegalArgumentException since certificate identity checking would be skipped.","triggerScenarios":"Setting quarkus.datasource.\"x\".reactive.postgresql.ssl-mode=verify-full while quarkus.datasource.reactive.hostname-verification-algorithm=NONE (or left at default NONE).","commonSituations":"Hardening a Postgres connection to verify-full without updating the algorithm property; keeping an old NONE setting from a dev environment when moving to production TLS.","solutions":["Set quarkus.datasource.reactive.hostname-verification-algorithm=HTTPS when ssl-mode=verify-full","Use ssl-mode=verify-ca instead if hostname verification is intentionally undesired","Audit all datasource configs (per-datasource overrides) so none pair verify-full with NONE"],"exampleFix":"// before\nquarkus.datasource.db.reactive.postgresql.ssl-mode=verify-full\nquarkus.datasource.reactive.hostname-verification-algorithm=NONE\n// after\nquarkus.datasource.db.reactive.postgresql.ssl-mode=verify-full\nquarkus.datasource.reactive.hostname-verification-algorithm=HTTPS","handlingStrategy":"validation","validationCode":"if (\"verify-full\".equals(sslMode)\n        && \"NONE\".equalsIgnoreCase(hostnameVerificationAlgorithm)) {\n    throw new IllegalStateException(\n        \"Set quarkus.datasource.reactive.hostname-verification-algorithm=HTTPS for verify-full\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    recorder.pgConnectOptionsList(...);\n} catch (IllegalArgumentException e) {\n    log.error(\"Fix ssl-mode/hostname-verification-algorithm combination\");\n    throw e;\n}","preventionTips":["Pair verify-full with an explicit algorithm (HTTPS)","Remove NONE algorithm defaults when enabling verify-full","Audit per-datasource TLS overrides for consistency"],"tags":["quarkus","postgresql","ssl","hostname-verification","configuration"],"backgroundTag":"ssl-mode-hostname-verification-mismatch","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}