{"record":{"id":"a9b2cf1124c6e1ad","repo":"quarkusio/quarkus","slug":"failed-to-initialized-ssl-context","errorCode":null,"errorMessage":"Failed to initialized SSL context","messagePattern":"Failed to initialized SSL context","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/QuarkusRestClientBuilder.java","lineNumber":395,"sourceCode":"                .createProxy(aClass, actualClient, true, getLocalProviderInstances(), client));\n    }\n\n    private void configureTrustAll(ResteasyClientBuilder clientBuilder) {\n        if (config == null) {\n            return;\n        }\n        Optional<Boolean> trustAll = config.getOptionalValue(TLS_TRUST_ALL, Boolean.class);\n        if (trustAll.isPresent() && trustAll.get()) {\n            clientBuilder.hostnameVerifier(new NoopHostnameVerifier());\n            try {\n                if (this.sslContext == null) {\n                    SSLContext sslContext = SSLContext.getInstance(\"TLS\");\n                    sslContext.init(null, new TrustManager[] { new PassthroughTrustManager() },\n                            new SecureRandom());\n                    clientBuilder.sslContext(sslContext);\n                }\n            } catch (NoSuchAlgorithmException | KeyManagementException e) {\n                throw new RuntimeException(\"Failed to initialized SSL context\", e);\n            }\n        }\n    }\n\n    @SuppressWarnings(\"unchecked\")\n    @Override\n    public <T> T build(Class<T> aClass) throws IllegalStateException, RestClientDefinitionException {\n        return build(aClass, null);\n    }\n\n    /**\n     * Get the users list of proxy hosts. Translate list to regex format\n     *\n     * @return list of proxy hosts\n     */\n    private List<String> getProxyHostsAsRegex() {\n        String noProxyHostsSysProps = System.getProperty(\"http.nonProxyHosts\", null);\n        if (noProxyHostsSysProps == null) {","sourceCodeStart":377,"sourceCodeEnd":413,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/QuarkusRestClientBuilder.java#L377-L413","documentation":"Wraps NoSuchAlgorithmException or KeyManagementException raised while creating a trust-all SSLContext (TLS with a PassthroughTrustManager) when the 'trust all' option is enabled. The JVM rejected TLS context creation/initialization, so the builder cannot configure the insecure client and throws RuntimeException.","triggerScenarios":"Setting quarkus.rest-client.<key>.trust-all=true (or verifyHost=false paths using this code) and the JVM's TLS provider fails to init the SSLContext — e.g. restricted crypto policy, broken JCE providers, or custom SecureRandom/provider issues.","commonSituations":"Unusual JDKs (FIPS, stripped-down runtimes) lacking default TLS algorithm; exotic java.security settings overriding the TLS provider; native-image builds missing crypto natives.","solutions":["Check the cause chain for NoSuchAlgorithmException vs KeyManagementException and fix the underlying JVM crypto config","Run on a standard JDK with default JCE providers; remove restrictive java.security overrides","Disable trust-all in production and configure a proper trust store (quarkus.rest-client.<key>.trust-store=...)","If on native image, ensure SSL/TLS native support is included (rebuild with the proper Quarkus SSL config)"],"exampleFix":"// before\nquarkus.rest-client.my-client.trust-all=true  // fails on FIPS JVM\n// after\nquarkus.rest-client.my-client.trust-all=false\nquarkus.rest-client.my-client.trust-store=/conf/truststore.p12\nquarkus.rest-client.my-client.trust-store-password=secret","handlingStrategy":"try-catch","validationCode":"// Verify TLS is creatable before enabling trust-all\ntry {\n    SSLContext.getInstance(\"TLS\").init(null, new TrustManager[] { tm }, new SecureRandom());\n} catch (NoSuchAlgorithmException | KeyManagementException e) {\n    throw new IllegalStateException(\"JVM cannot init TLS context; do not enable trust-all\", e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    client = builder.build(MyClient.class);\n} catch (RuntimeException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"Failed to initialized SSL context\")) {\n        log.error(\"TLS init failed; check JCE providers/java.security\", e.getCause());\n    }\n    throw e;\n}","preventionTips":["Avoid trust-all in production; use an explicit trust store instead","Run on a standard JDK with default JCE providers","Audit custom java.security settings that replace the TLS provider","Test SSL config in the actual runtime image (including native builds)"],"tags":["rest-client","ssl","tls","trust-all","security"],"backgroundTag":"ssl-context-init-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}