{"record":{"id":"ccfe4fb3637e9b29","repo":"quarkusio/quarkus","slug":"key-cert-options-have-already-been-set","errorCode":null,"errorMessage":"Key cert options have already been set","messagePattern":"Key cert options have already been set","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/grpc/runtime/src/main/java/io/quarkus/grpc/runtime/supports/SSLConfigHelper.java","lineNumber":119,"sourceCode":"    public static void configureJksKeyCertOptions(TCPSSLOptions options,\n            GrpcClientConfiguration.TlsClientConfig.JksConfiguration configuration) {\n        if (configuration.path().isPresent()) {\n            ensureKeyCertOptionsNotSet(options);\n            options.setKeyCertOptions(toJksOptions(configuration));\n        }\n    }\n\n    public static void configurePfxKeyCertOptions(TCPSSLOptions options,\n            GrpcClientConfiguration.TlsClientConfig.PfxConfiguration configuration) {\n        if (configuration.path().isPresent()) {\n            ensureKeyCertOptionsNotSet(options);\n            options.setKeyCertOptions(toPfxOptions(configuration));\n        }\n    }\n\n    private static void ensureKeyCertOptionsNotSet(TCPSSLOptions options) {\n        if (options.getKeyCertOptions() != null) {\n            throw new IllegalArgumentException(\"Key cert options have already been set\");\n        }\n    }\n\n    private SSLConfigHelper() {\n        // Utility\n    }\n}\n","sourceCodeStart":101,"sourceCodeEnd":127,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/grpc/runtime/src/main/java/io/quarkus/grpc/runtime/supports/SSLConfigHelper.java#L101-L127","documentation":"SSLConfigHelper.configureXxxKeyCertOptions methods install PEM/JKS/PFX key & certificate material onto Vert.x TCPSSLOptions. ensureKeyCertOptionsNotSet throws IllegalArgumentException if keyCertOptions was already set, preventing one key/cert source from silently replacing another.","triggerScenarios":"Configuring both key-certificate-pem and key-store-jks (or pfx) for the same gRPC client/server TLS config; calling two configureXxxKeyCertOptions methods on the same TCPSSLOptions object.","commonSituations":"Having both tls.key-store and tls.certificate/key settings for one client; leftover config from a migration between PEM files and a keystore; programmatic setup followed by config application.","solutions":["Keep only one key/certificate configuration source for the given client/server","Delete the redundant key-store or key-certificate-* property","If both formats are needed for different clients, scope each under its own quarkus.grpc.clients.<name>.tls config"],"exampleFix":"// before\nquarkus.grpc.servers.hello.tls.key-certificate-pem.keys=cert.key\nquarkus.grpc.servers.hello.tls.key-store-jks.path=server.jks\n// after\nquarkus.grpc.servers.hello.tls.key-certificate-pem.keys=cert.key\nquarkus.grpc.servers.hello.tls.key-certificate-pem.certs=cert.crt","handlingStrategy":"validation","validationCode":"if (options.getKeyCertOptions() != null) {\n    throw new IllegalArgumentException(\"Choose one key/cert source: PEM, JKS or PFX\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    SSLConfigHelper.configurePemKeyCertOptions(options, cfg);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"Key cert options\")) {\n        LOG.error(\"Key/cert set twice — remove the redundant keystore or PEM entry\");\n    }\n    throw e;\n}","preventionTips":["Keep only one key-certificate config per client/server","Remove stale key-store entries after migrating to PEM","Review merged profiles (dev/prod) for overlapping TLS keys"],"tags":["grpc","tls","configuration","ssl","quarkus"],"backgroundTag":"duplicate-ssl-configuration","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}