{"record":{"id":"d00eb9e3f16fc5cb","repo":"quarkusio/quarkus","slug":"baseurl-requires-ssl-support-but-it-is-disabled","errorCode":null,"errorMessage":"${baseUrl} requires SSL support but it is disabled. You probably have set quarkus.ssl.native to false.","messagePattern":"(.+?) requires SSL support but it is disabled\\. You probably have set quarkus\\.ssl\\.native to false\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"critical","filePath":"extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java","lineNumber":302,"sourceCode":"        if (((baseUriFromAnnotation == null) || baseUriFromAnnotation.isEmpty()) && baseUrlOptional.isEmpty()) {\n            String propertyPrefix = configKey != null ? configKey : proxyType.getName();\n            throw new IllegalArgumentException(\n                    String.format(\n                            \"Unable to determine the proper baseUrl/baseUri. \" +\n                                    \"Consider registering using @RegisterRestClient(baseUri=\\\"someuri\\\"), @RegisterRestClient(configKey=\\\"orkey\\\"), \"\n                                    +\n                                    \"or by adding '%s' or '%s' to your Quarkus configuration\",\n                            String.format(QUARKUS_CONFIG_REST_URL_FORMAT, propertyPrefix),\n                            String.format(QUARKUS_CONFIG_REST_URI_FORMAT, propertyPrefix)));\n        }\n        String baseUrl = baseUrlOptional.orElse(baseUriFromAnnotation);\n\n        try {\n            builder.baseUrl(new URL(baseUrl));\n        } catch (MalformedURLException e) {\n            if (e.getMessage().contains(\n                    \"It must be enabled by adding the --enable-url-protocols=https option to the native-image command\")) {\n                throw new IllegalArgumentException(baseUrl\n                        + \" requires SSL support but it is disabled. You probably have set quarkus.ssl.native to false.\");\n            }\n            throw new IllegalArgumentException(\"The value of URL was invalid \" + baseUrl, e);\n        }\n    }\n\n    @SafeVarargs\n    private static <T> Optional<T> oneOf(Optional<T>... optionals) {\n        for (Optional<T> o : optionals) {\n            if (o != null && o.isPresent()) {\n                return o;\n            }\n        }\n        return Optional.empty();\n    }\n\n    private static OptionalInt oneOf(OptionalInt... optionals) {\n        for (OptionalInt o : optionals) {","sourceCodeStart":284,"sourceCodeEnd":320,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java#L284-L320","documentation":"When builder.baseUrl(new URL(...)) throws MalformedURLException whose message mentions the GraalVM native-image https flag, Quarkus rethrows this clearer error: the URL uses https but SSL support was compiled out of the native executable (quarkus.ssl.native=false or SSL disabled at build time).","triggerScenarios":"Running a native-image build with https not in --enable-url-protocols; typically caused by setting quarkus.ssl.native=false while the REST client targets an https:// base URL.","commonSituations":"Teams disable SSL globally to shrink native binaries, then add an https client later; a base URL changed from http to https without revisiting native SSL config; CI builds with -Dquarkus.ssl.native=false optimizations.","solutions":["Remove quarkus.ssl.native=false so SSL is enabled in the native build (default is enabled when SSL is used)","Or keep it disabled and switch this client's URL to http:// only if the endpoint truly allows plaintext","Rebuild the native image after changing the flag — the fix cannot be applied at runtime","Set -H:EnableURLProtocols=https explicitly in native-image args if configuring manually"],"exampleFix":"// before (application.properties)\nquarkus.ssl.native=false\nquarkus.rest-client.secure-api.url=https://api.example.com\n// after\nquarkus.ssl.native=true\nquarkus.rest-client.secure-api.url=https://api.example.com","handlingStrategy":"validation","validationCode":"// fail the build if SSL is disabled while any client uses https\nboolean sslNative = Boolean.parseBoolean(System.getProperty(\"quarkus.ssl.native\", \"true\"));\nString url = \"https://api.example.com\";\nif (!sslNative && url.startsWith(\"https://\")) {\n    throw new IllegalStateException(\"https URL used but quarkus.ssl.native=false\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Do not set quarkus.ssl.native=false unless every endpoint is http","Re-run native builds in CI when SSL flags or URLs change","Grep config for https:// URLs whenever SSL build flags are touched","Keep native-image SSL options in one reviewed build profile"],"tags":["native-image","ssl","graalvm","rest-client"],"backgroundTag":"ssl-disabled-native","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}