{"record":{"id":"9fbfd148a85b61a3","repo":"quarkusio/quarkus","slug":"cannot-configure-tls-configuration-name-programmat","errorCode":null,"errorMessage":"Cannot configure TLS configuration name programmatically because it  has already been configured with the 'quarkus.http.tls-configuration-name' configuration property","messagePattern":"Cannot configure TLS configuration name programmatically because it  has already been configured with the 'quarkus\\.http\\.tls-configuration-name' configuration property","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java","lineNumber":146,"sourceCode":"            if (actualRealm != null) {\n                throw new IllegalArgumentException(\"Cannot configure basic authentication programmatically because \"\n                        + \"the authentication realm has already been configured in the 'application.properties' file\");\n            }\n        } else if (mechanism.getClass() == MtlsAuthenticationMechanism.class) {\n            boolean mTlsEnabled = !ClientAuth.NONE.equals(clientAuth);\n            if (mTlsEnabled) {\n                // current we do not allow \"merging\" (or overriding) of the configuration provided in application.properties\n                // there shouldn't be a technical issue allowing that, but that's the behavior we have for other mechanisms\n                // as well, so this method only allows to \"enable\" mTLS, never disable or change configuration provided\n                // properties file\n                throw new IllegalArgumentException(\"TLS client authentication has already been enabled with this API or\"\n                        + \" with the 'quarkus.http.ssl.client-auth' configuration property\");\n            }\n            var mTLS = ((MtlsAuthenticationMechanism) mechanism);\n            clientAuth = mTLS.getTlsClientAuth();\n            if (mTLS.getHttpServerTlsConfigName().isPresent()) {\n                if (httpServerTlsConfigName.isPresent()) {\n                    throw new IllegalArgumentException(\"Cannot configure TLS configuration name programmatically because it \"\n                            + \" has already been configured with the 'quarkus.http.tls-configuration-name' configuration property\");\n                }\n                httpServerTlsConfigName = mTLS.getHttpServerTlsConfigName();\n                if (mTLS.getInitialTlsConfiguration() != null) {\n                    TlsConfigurationRegistry tlsConfigurationRegistry = Arc.container().instance(TlsConfigurationRegistry.class)\n                            .get();\n                    if (tlsConfigurationRegistry.get(httpServerTlsConfigName.get()).isPresent()) {\n                        throw new IllegalArgumentException((\"Cannot register the TLS configuration '%s' in the TLS \"\n                                + \"Configuration registry because configuration with this name has already\"\n                                + \" been registered\").formatted(httpServerTlsConfigName.get()));\n                    }\n                    tlsConfigurationRegistry.register(httpServerTlsConfigName.get(), mTLS.getInitialTlsConfiguration());\n                }\n            }\n        }\n        this.mechanisms.add(mechanism);\n        return this;\n    }","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java#L128-L164","documentation":"When an MtlsAuthenticationMechanism carries a named TLS configuration (set via quarkus.tls.<name>.* on the mechanism), Quarkus stores it as httpServerTlsConfigName. If a TLS configuration name was already provided — either through the quarkus.http.tls-configuration-name property or a previous programmatic registration — the second assignment throws an IllegalArgumentException because two named TLS configs cannot be reconciled.","triggerScenarios":"Registering an mTLS mechanism with getHttpServerTlsConfigName() present while application.properties sets quarkus.http.tls-configuration-name, or while an earlier mechanism() call already set httpServerTlsConfigName.","commonSituations":"Apps switching to the TLS registry naming scheme while quarkus.http.tls-configuration-name remains defined; registering two mTLS mechanisms each with their own named TLS config.","solutions":["Remove quarkus.http.tls-configuration-name from application.properties so the programmatic TLS config name is the only one.","Set the TLS configuration name in only one place — either the mechanism or the property, not both.","If multiple TLS configs are needed, register them in the TlsConfigurationRegistry under distinct names and reference them consistently."],"exampleFix":"// before (application.properties)\nquarkus.http.tls-configuration-name=server-tls\n// code: mechanism(MTLS.named(\"server-tls\")) // throws\n// after: remove the property, then configure the name only via the mechanism","handlingStrategy":"validation","validationCode":"// ensure quarkus.http.tls-configuration-name is unset before naming a TLS config programmatically\n// ConfigProvider.getConfig().getOptionalValue(\"quarkus.http.tls-configuration-name\", String.class)\n//     .ifPresent(n -> { throw new IllegalStateException(\"TLS config name already set in properties\"); });","typeGuard":null,"tryCatchPattern":"try {\n    httpSecurity.mechanism(mtlsMechanism);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"TLS configuration name\")) {\n        log.warn(\"quarkus.http.tls-configuration-name already set; properties value will be used\");\n    } else {\n        throw e;\n    }\n}","preventionTips":["Set the HTTP TLS configuration name in exactly one place: property or mechanism.","Name distinct TLS configurations uniquely in the TLS registry.","When migrating to the TLS registry, delete the old quarkus.http.tls-configuration-name entry."],"tags":["quarkus","http-security","mtls","tls-registry","duplicate-configuration"],"backgroundTag":"duplicate-configuration-source","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}