{"record":{"id":"c82ec1a339e5748f","repo":"quarkusio/quarkus","slug":"ocsp-is-not-supported-with-this-sslprovider","errorCode":null,"errorMessage":"OCSP is not supported with this SslProvider: ","messagePattern":"OCSP is not supported with this SslProvider: ","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/netty/runtime/src/main/java/io/quarkus/netty/runtime/graal/NettySubstitutions.java","lineNumber":273,"sourceCode":"\n    }\n}\n\n@TargetClass(className = \"io.netty.handler.ssl.SslContext\")\nfinal class Target_io_netty_handler_ssl_SslContext {\n\n    @Substitute\n    static SslContext newServerContextInternal(SslProvider provider,\n            Provider sslContextProvider,\n            X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,\n            X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,\n            Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,\n            long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth, String[] protocols, boolean startTls,\n            boolean enableOcsp, SecureRandom secureRandom, String keyStoreType,\n            Map.Entry<SslContextOption<?>, Object>[] ctxOptions,\n            List<OpenSslCredential> credentials) throws SSLException {\n        if (enableOcsp) {\n            throw new IllegalArgumentException(\"OCSP is not supported with this SslProvider: \" + provider);\n        }\n        Target_io_netty_handler_ssl_ResumptionController resumptionController = new Target_io_netty_handler_ssl_ResumptionController();\n        return (SslContext) (Object) new Target_io_netty_handler_ssl_JdkSslServerContext(sslContextProvider,\n                trustCertCollection, trustManagerFactory, keyCertChain, key, keyPassword,\n                keyManagerFactory, ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout,\n                clientAuth, protocols, startTls, secureRandom, keyStoreType, resumptionController);\n    }\n\n    @Substitute\n    static SslContext newClientContextInternal(SslProvider provider,\n            Provider sslContextProvider,\n            X509Certificate[] trustCert, TrustManagerFactory trustManagerFactory,\n            X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,\n            Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, String[] protocols,\n            long sessionCacheSize, long sessionTimeout, boolean enableOcsp,\n            SecureRandom secureRandom, String keyStoreType, String endpointIdentificationAlgorithm,\n            List<SNIServerName> serverNames,\n            Map.Entry<SslContextOption<?>, Object>[] options,","sourceCodeStart":255,"sourceCodeEnd":291,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/netty/runtime/src/main/java/io/quarkus/netty/runtime/graal/NettySubstitutions.java#L255-L291","documentation":"Netty's JDK (non-OpenSSL) SSL provider cannot perform OCSP stapling. This Quarkus native-image substitution of Netty's JdkSslServerContext creation path checks the enableOcsp flag and throws IllegalArgumentException when OCSP is requested with a provider that cannot support it, instead of silently ignoring the option.","triggerScenarios":"Building/running a native-image Quarkus app where SslContextBuilder is used to create a server SSL context with SslContextOption.ENABLE_OCSP (or the enableOcsp parameter) set to true while the provider is the JDK/JDK-default SslProvider rather than OpenSSL.","commonSituations":"Enabling OCSP stapling in Netty TLS configuration while running on the JDK SSL provider; Quarkus native mode where the OpenSSL provider is unavailable so the JDK substitution path is used; copying OpenSSL-provider config code onto the JDK provider.","solutions":["Disable OCSP: pass enableOcsp=false / remove the ENABLE_OCSP SslContextOption.","Use the OpenSSL (netty-tcnative) provider, e.g. SslProvider.OPENSSL_REFCNT, which supports OCSP.","Verify which SslProvider is actually selected at runtime and align your OCSP expectations with it."],"exampleFix":"// before\nSslContext ctx = SslContextBuilder.forServer(keyCertChain, key)\n        .sslProvider(SslProvider.JDK)\n        .startTls(true)\n        .option(SslContextOption.ENABLE_OCSP, true)\n        .build();\n// after\nSslContext ctx = SslContextBuilder.forServer(keyCertChain, key)\n        .sslProvider(SslProvider.OPENSSL_REFCNT) // OCSP-capable provider\n        .startTls(true)\n        .option(SslContextOption.ENABLE_OCSP, true)\n        .build();","handlingStrategy":"validation","validationCode":"if (enableOcsp && provider == SslProvider.JDK) {\n    throw new IllegalArgumentException(\"OCSP requires the OpenSSL provider, not JDK\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    SslContext ctx = builder.build();\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"OCSP is not supported\")) {\n        ctx = builder.option(SslContextOption.ENABLE_OCSP, false).build();\n    } else { throw e; }\n}","preventionTips":["Only set ENABLE_OCSP when SslProvider is OPENSSL/OPENSSL_REFCNT","Confirm the active SslProvider in native-image builds (substitutions change the path)","Gate OCSP options behind a config check of the selected provider"],"tags":["netty","ssl","tls","ocsp","native-image"],"backgroundTag":"ocsp-unsupported-provider","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}