{"record":{"id":"9f42cca6f7446fb5","repo":"quarkusio/quarkus","slug":"this-verification-path-not-implemented","errorCode":null,"errorMessage":"This verification path not implemented","messagePattern":"This verification path not implemented","errorType":"exception","errorClass":"SSLException","httpStatus":null,"severity":"error","filePath":"extensions/keycloak-authorization/runtime/src/main/java/io/quarkus/keycloak/pep/runtime/HttpClientBuilder.java","lineNumber":243,"sourceCode":"        return this;\n    }\n\n    static class VerifierWrapper implements X509HostnameVerifier {\n        protected HostnameVerifier verifier;\n\n        VerifierWrapper(HostnameVerifier verifier) {\n            this.verifier = verifier;\n        }\n\n        @Override\n        public void verify(String host, SSLSocket ssl) throws IOException {\n            if (!verifier.verify(host, ssl.getSession()))\n                throw new SSLException(\"Hostname verification failure\");\n        }\n\n        @Override\n        public void verify(String host, X509Certificate cert) throws SSLException {\n            throw new SSLException(\"This verification path not implemented\");\n        }\n\n        @Override\n        public void verify(String host, String[] cns, String[] subjectAlts) throws SSLException {\n            throw new SSLException(\"This verification path not implemented\");\n        }\n\n        @Override\n        public boolean verify(String s, SSLSession sslSession) {\n            return verifier.verify(s, sslSession);\n        }\n    }\n\n    public HttpClientBuilder spNegoSchemeFactory(SPNegoSchemeFactory spnegoSchemeFactory) {\n        this.spNegoSchemeFactory = spnegoSchemeFactory;\n        return this;\n    }\n","sourceCodeStart":225,"sourceCodeEnd":261,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/keycloak-authorization/runtime/src/main/java/io/quarkus/keycloak/pep/runtime/HttpClientBuilder.java#L225-L261","documentation":"The Keycloak HttpClientBuilder wraps a hostname verifier and deliberately throws this SSLException for the verify(String host, X509Certificate cert) overload, because the adapter only implements session-based hostname verification. It indicates the HTTP client attempted a certificate-only verification path that this adapter does not support.","triggerScenarios":"The Apache HttpClient (or a transport layer) invokes the X509Certificate-based verify overload during a TLS handshake instead of the SSLSession-based path — typically when a custom connection setup or alternate HttpClient implementation routes verification through that overload.","commonSituations":"Using the Keycloak PEP client in an environment where the HTTP client's TLS layer selects the certificate-only verification callback; unusual proxy or custom SSLConnectionSocketFactory setups interacting with the adapter's builder.","solutions":["Avoid the unsupported path: use the standard HttpClientBuilder produced by the adapter (default configuration) so the SSLSession-based verify is used.","Update the quarkus-keycloak-authorization extension — newer versions may implement or remove this path.","If you control the connection factory, ensure hostname verification goes through verify(String, SSLSocket) / verify(String, SSLSession)."],"exampleFix":"// before: custom socket factory routing to cert-only verify\nnew SSLConnectionSocketFactory(customContext, new X509HostnameVerifier() { ... })\n// after: let the adapter build the client\nCloseableHttpClient client = HttpClientBuilder.create(adapterConfig).build();","handlingStrategy":"try-catch","validationCode":"// ensure you use the adapter's standard builder, not a custom X509HostnameVerifier path\nif (socketFactory instanceof SSLConnectionSocketFactory f && usesLegacyVerifier(f)) {\n    throw new IllegalStateException(\"Remove legacy X509HostnameVerifier wiring\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    return HttpClientBuilder.create(adapterConfig).build();\n} catch (SSLException e) {\n    if (\"This verification path not implemented\".equals(e.getMessage())) {\n        log.warn(\"Fell into unsupported cert-only hostname verify path; check custom TLS wiring\");\n    }\n    throw e;\n}","preventionTips":["Do not install custom X509HostnameVerifier implementations around the Keycloak HTTP client.","Keep the quarkus-keycloak-authorization extension up to date.","Test HTTPS calls to Keycloak in an integration test to surface unsupported TLS paths early."],"tags":["ssl","keycloak","unsupported-operation"],"backgroundTag":"ssl-verification-path-unsupported","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}