{"record":{"id":"b46cdf2aef892ea6","repo":"quarkusio/quarkus","slug":"cannot-register-the-tls-configuration-s-in-the","errorCode":null,"errorMessage":"Cannot register the TLS configuration '%s' in the TLS Configuration registry because configuration with this name has already been registered","messagePattern":"Cannot register the TLS configuration '(.+?)' in the TLS Configuration registry because configuration with this name has already been registered","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java","lineNumber":154,"sourceCode":"                // there shouldn't be a technical issue allowing that, but that's the behavior we have for other mechanisms\n                // as well, so this method only allows to \"enable\" mTLS, never disable or change configuration provided\n                // properties file\n                throw new IllegalArgumentException(\"TLS client authentication has already been enabled with this API or\"\n                        + \" with the 'quarkus.http.ssl.client-auth' configuration property\");\n            }\n            var mTLS = ((MtlsAuthenticationMechanism) mechanism);\n            clientAuth = mTLS.getTlsClientAuth();\n            if (mTLS.getHttpServerTlsConfigName().isPresent()) {\n                if (httpServerTlsConfigName.isPresent()) {\n                    throw new IllegalArgumentException(\"Cannot configure TLS configuration name programmatically because it \"\n                            + \" has already been configured with the 'quarkus.http.tls-configuration-name' configuration property\");\n                }\n                httpServerTlsConfigName = mTLS.getHttpServerTlsConfigName();\n                if (mTLS.getInitialTlsConfiguration() != null) {\n                    TlsConfigurationRegistry tlsConfigurationRegistry = Arc.container().instance(TlsConfigurationRegistry.class)\n                            .get();\n                    if (tlsConfigurationRegistry.get(httpServerTlsConfigName.get()).isPresent()) {\n                        throw new IllegalArgumentException((\"Cannot register the TLS configuration '%s' in the TLS \"\n                                + \"Configuration registry because configuration with this name has already\"\n                                + \" been registered\").formatted(httpServerTlsConfigName.get()));\n                    }\n                    tlsConfigurationRegistry.register(httpServerTlsConfigName.get(), mTLS.getInitialTlsConfiguration());\n                }\n            }\n        }\n        this.mechanisms.add(mechanism);\n        return this;\n    }\n\n    @Override\n    public HttpSecurity basic() {\n        return mechanism(Basic.create());\n    }\n\n    @Override\n    public HttpSecurity basic(String authenticationRealm) {","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java#L136-L172","documentation":"Before registering the mTLS mechanism's initial TlsConfiguration into the TlsConfigurationRegistry, Quarkus checks whether a configuration with that name already exists. Duplicate names would make TLS resolution ambiguous, so the registration is rejected with an IllegalArgumentException naming the conflicting configuration.","triggerScenarios":"Registering an mTLS mechanism whose getInitialTlsConfiguration() is non-null and whose httpServerTlsConfigName already has an entry in the TlsConfigurationRegistry (e.g. registered earlier in code or by another extension).","commonSituations":"Re-running security setup code that registers the same named TLS config twice; two different mechanisms trying to register TLS configurations under the same name; dev-mode hot reload re-executing registration without clearing the registry.","solutions":["Choose a unique name for the TLS configuration being registered programmatically.","Check tlsConfigurationRegistry.get(name).isPresent() before registering and skip or rename on conflict.","If the existing configuration is correct, do not register a new one — reference the existing name instead."],"exampleFix":"// before\nTlsConfiguration cfg = buildTlsConfig();\nmechanism(MTLS.tlsConfig(\"my-tls\", cfg)); // throws if \"my-tls\" registered\n// after\nif (Arc.container().instance(TlsConfigurationRegistry.class).get().get(\"my-tls\").isEmpty()) {\n    mechanism(MTLS.tlsConfig(\"my-tls\", buildTlsConfig()));\n}","handlingStrategy":"validation","validationCode":"TlsConfigurationRegistry registry = Arc.container().instance(TlsConfigurationRegistry.class).get();\nif (registry.get(\"my-tls\").isPresent()) {\n    log.info(\"TLS config 'my-tls' already registered; skipping registration\");\n} else {\n    registry.register(\"my-tls\", buildTlsConfig());\n}","typeGuard":null,"tryCatchPattern":"try {\n    httpSecurity.mechanism(mtlsMechanism);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"already\" ) && e.getMessage().contains(\"TLS Configuration registry\")) {\n        log.warn(\"Named TLS config already registered; reusing existing entry\");\n    } else {\n        throw e;\n    }\n}","preventionTips":["Always check registry.get(name).isPresent() before registering a named TLS config.","Use unique, app-prefixed TLS config names to avoid collisions with extensions.","Make registration idempotent for dev-mode reloads."],"tags":["quarkus","http-security","mtls","tls-registry","duplicate-registration"],"backgroundTag":"duplicate-registration","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}