{"record":{"id":"c7ae27f0df76f9a4","repo":"quarkusio/quarkus","slug":"tls-configuration-is-already-set","errorCode":null,"errorMessage":"TLS configuration is already set","messagePattern":"TLS configuration is already set","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/security/MTLS.java","lineNumber":153,"sourceCode":"            this.clientAuth = ClientAuth.REQUIRED;\n            this.certificateAttributeValueToRoles = null;\n            this.httpServerTlsConfigName = Optional.empty();\n            this.tlsConfiguration = null;\n            this.priority = Optional.empty();\n        }\n\n        /**\n         * Configures the name of the TLS configuration used by the HTTP server for the TLS communication.\n         * Please note that this method is mutually exclusive with the 'quarkus.http.tls-configuration-name'\n         * configuration property.\n         *\n         * @param tlsConfigurationName the name of the configuration, cannot be {@code <default>}\n         * @return Builder\n         * @see VertxHttpConfig#tlsConfigurationName() for more information\n         */\n        public Builder tls(String tlsConfigurationName) {\n            if (tlsConfiguration != null) {\n                throw new IllegalStateException(\"TLS configuration is already set\");\n            }\n            this.httpServerTlsConfigName = Optional.ofNullable(tlsConfigurationName);\n            return this;\n        }\n\n        /**\n         * Registers a TLS configuration into the registry and configures the TLS configuration used by the HTTP server\n         * for the TLS communication. Please note that this method is mutually exclusive with\n         * the 'quarkus.http.tls-configuration-name' configuration property and if the configuration with this name\n         * is already registered in the TLS registry, validation will fail.\n         * <p>\n         * The passed TLS configuration is not validated, so it's up to the caller to ensure the configuration is correct.\n         *\n         * @param tlsConfigurationName the name of the configuration, cannot be {@code null}, cannot be {@code <default>}\n         * @param tlsConfiguration the configuration cannot be {@code null}\n         * @return Builder\n         * @see io.quarkus.tls.TlsConfigurationRegistry#register(String, TlsConfiguration)\n         * @see VertxHttpConfig#tlsConfigurationName()","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/security/MTLS.java#L135-L171","documentation":"MTLS.Builder.tls(String) throws IllegalStateException when a TLS configuration was already set on this builder. The builder allows only one TLS configuration source, so calling tls(name) after a previous tls(...) call conflicts.","triggerScenarios":"Calling tls(tlsConfigurationName) twice, or calling tls(name) after tls(name, tlsConfiguration) was already invoked.","commonSituations":"Copy-pasted builder setup where TLS is configured both conditionally and unconditionally; merging default and custom TLS setup code paths; both application.properties TLS config and programmatic config applied.","solutions":["Call tls() only once per builder","Remove the redundant tls() call or restructure so only one path sets TLS","Create a fresh MTLS.Builder if a different TLS config is needed"],"exampleFix":"// before\nbuilder.tls(\"default-tls\");\nif (custom) {\n    builder.tls(\"custom-tls\"); // IllegalStateException\n}\n// after\nbuilder.tls(custom ? \"custom-tls\" : \"default-tls\");","handlingStrategy":"validation","validationCode":"// ensure tls() is invoked at most once per builder\nboolean tlsSet = false;\nvoid setTls(MTLS.Builder b, String name) {\n    if (tlsSet) throw new IllegalStateException(\"tls already configured\");\n    b.tls(name);\n    tlsSet = true;\n}","typeGuard":null,"tryCatchPattern":"try {\n    builder.tls(name);\n} catch (IllegalStateException e) {\n    // TLS already set — keep existing configuration or use a new builder\n}","preventionTips":["Configure TLS in exactly one code path","Do not mix conditional and unconditional tls() calls","Track builder state when wrapping builder setup in helpers"],"tags":["quarkus","mtls","illegal-state","builder-misuse","tls"],"backgroundTag":"builder-state-conflict","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}