{"record":{"id":"dae8bbfe4e558bc6","repo":"quarkusio/quarkus","slug":"unable-to-create-default-sslcontext","errorCode":null,"errorMessage":"Unable to create default SSLContext","messagePattern":"Unable to create default SSLContext","errorType":"exception","errorClass":"MongoClientException","httpStatus":null,"severity":"error","filePath":"extensions/mongodb-client/runtime/src/main/java/io/quarkus/mongodb/runtime/graal/MongoClientSubstitutions.java","lineNumber":105,"sourceCode":"    @Substitute\n    public Stream create(final ServerAddress serverAddress) {\n        Stream stream;\n        if (sslSettings.isEnabled()) {\n            stream = new SocketStream(serverAddress, inetAddressResolver, settings, sslSettings,\n                    getSslContext().getSocketFactory(), bufferProvider);\n        } else {\n            stream = new SocketStream(serverAddress, inetAddressResolver, settings, sslSettings,\n                    SocketFactory.getDefault(), bufferProvider);\n        }\n        return stream;\n    }\n\n    @Alias\n    private SSLContext getSslContext() {\n        try {\n            return (sslSettings.getContext() == null) ? SSLContext.getDefault() : sslSettings.getContext();\n        } catch (NoSuchAlgorithmException e) {\n            throw new MongoClientException(\"Unable to create default SSLContext\", e);\n        }\n    }\n}\n\n@TargetClass(className = \"com.mongodb.internal.connection.Compressor\")\nfinal class CompressorSubstitute {\n\n}\n\n@TargetClass(InternalStreamConnection.class)\nfinal class InternalStreamConnectionSubstitution {\n    @Substitute\n    private CompressorSubstitute createCompressor(final MongoCompressor mongoCompressor) {\n        throw new UnsupportedOperationException(\"Unsupported compressor in native mode\");\n    }\n}\n\n@TargetClass(UnixSocketChannelStream.class)","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/mongodb-client/runtime/src/main/java/io/quarkus/mongodb/runtime/graal/MongoClientSubstitutions.java#L87-L123","documentation":"The getSslContext substitution wraps SSLContext.getDefault(); if no default SSL algorithm is available (NoSuchAlgorithmException, e.g. missing TLS provider in the native image) it wraps the failure in a MongoClientException with this message. It occurs while creating an SSL-enabled MongoDB connection in native mode.","triggerScenarios":"Creating a MongoClient in native mode with TLS enabled (ssl=true or mongodb+srv:// URI) when sslSettings.getContext() is null and SSLContext.getDefault() fails because the TLS algorithm/provider is not registered in the native image.","commonSituations":"Native-image build missing the SSL/TSL native libraries or Graal's native SSL support (e.g. built without --enable-all-security-services equivalent or missing quarkus.ssl.native=true); stripped-down container images lacking CA/security providers.","solutions":["Ensure native-image SSL support is enabled (quarkus.ssl.native=true, set automatically by quarkus-tls-registry/ssl extension)","Verify the native image includes TLS providers (oracle/graal SSL natives present)","Pass an explicit SSLContext via MongoClientSettings instead of relying on the default","Run in JVM mode to confirm it is native-image specific"],"exampleFix":"// before\nquarkus.mongodb.connection-string=mongodb+srv://host/db\n// (native build missing SSL natives)\n// after\n# rebuild ensuring SSL natives are included\nquarkus.ssl.native=true","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    mongoClient = MongoClients.create(settings);\n} catch (MongoClientException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"SSLContext\")) {\n        // rebuild native image with SSL natives or supply explicit SSLContext\n        throw new IllegalStateException(\"TLS unavailable in native image; rebuild with SSL support\", e);\n    }\n    throw e;\n}","preventionTips":["Ensure quarkus.ssl.native=true (or the ssl extension is present) before native builds","Smoke-test TLS connections against the native build in CI","Supply an explicit SSLContext in MongoClientSettings rather than relying on the JVM default"],"tags":["mongodb","ssl","native-image","tls"],"backgroundTag":"ssl-context-unavailable","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}