{"record":{"id":"f78478c6753e5b04","repo":"quarkusio/quarkus","slug":"quarkus-datasource-reactive-hostname-verification","errorCode":null,"errorMessage":"quarkus.datasource.reactive.hostname-verification-algorithm must be specified under verify-identity sslmode","messagePattern":"quarkus\\.datasource\\.reactive\\.hostname-verification-algorithm must be specified under verify-identity sslmode","errorType":"exception","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/reactive-mysql-client/runtime/src/main/java/io/quarkus/reactive/mysql/client/runtime/MySQLPoolRecorder.java","lineNumber":166,"sourceCode":"            if (dataSourceReactiveMySQLConfig.serverRsaPublicKeyValue().isPresent()) {\n                mysqlConnectOptions\n                        .setServerRsaPublicKeyValue(\n                                Buffer.buffer(dataSourceReactiveMySQLConfig.serverRsaPublicKeyValue().get()));\n            }\n\n            if (dataSourceReactiveMySQLConfig.pipeliningLimit().isPresent()) {\n                mysqlConnectOptions.setPipeliningLimit(dataSourceReactiveMySQLConfig.pipeliningLimit().getAsInt());\n            }\n\n            dataSourceReactiveMySQLConfig.useAffectedRows().ifPresent(mysqlConnectOptions::setUseAffectedRows);\n\n            if (dataSourceReactiveMySQLConfig.sslMode().isPresent()) {\n                final SslMode sslMode = dataSourceReactiveMySQLConfig.sslMode().get();\n                mysqlConnectOptions.setSslMode(sslMode);\n\n                var algo = dataSourceReactiveRuntimeConfig.hostnameVerificationAlgorithm();\n                if (\"NONE\".equalsIgnoreCase(algo) && sslMode == SslMode.VERIFY_IDENTITY) {\n                    throw new IllegalArgumentException(\n                            \"quarkus.datasource.reactive.hostname-verification-algorithm must be specified under verify-identity sslmode\");\n                }\n            } else if (dataSourceReactiveRuntimeConfig.tlsConfigurationName().isPresent()) {\n                // Auto-enable SSL mode when a named TLS configuration is set\n                mysqlConnectOptions.setSslMode(SslMode.REQUIRED);\n            }\n\n            dataSourceReactiveMySQLConfig.authenticationPlugin().ifPresent(mysqlConnectOptions::setAuthenticationPlugin);\n\n            ReactivePoolUtil.configureSsl(mysqlConnectOptions, dataSourceReactiveRuntimeConfig, tlsRegistry);\n\n            dataSourceReactiveRuntimeConfig.additionalProperties().forEach(mysqlConnectOptions::addProperty);\n\n            // Use the convention defined by Quarkus Micrometer Vert.x metrics to create metrics prefixed with mysql.\n            // and the client_name as tag.\n            // See io.quarkus.micrometer.runtime.binder.vertx.VertxMeterBinderAdapter.extractPrefix and\n            // io.quarkus.micrometer.runtime.binder.vertx.VertxMeterBinderAdapter.extractClientName\n            mysqlConnectOptions.setMetricsName(\"mysql|\" + dataSourceName);","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/reactive-mysql-client/runtime/src/main/java/io/quarkus/reactive/mysql/client/runtime/MySQLPoolRecorder.java#L148-L184","documentation":"MySQLPoolRecorder.toMySQLConnectOptions validates that hostname verification is actually performed when ssl-mode=verify-identity. Vert.x's MySQL SslMode.VERIFY_IDENTITY requires an algorithm (e.g. HTTPS); if quarkus.datasource.reactive.hostname-verification-algorithm is NONE, the recorder throws IllegalArgumentException because identity would never be verified.","triggerScenarios":"Configuring quarkus.datasource.\"x\".reactive.mysql.ssl-mode=verify-identity together with quarkus.datasource.reactive.hostname-verification-algorithm=NONE (or leaving it at its NONE default).","commonSituations":"Enabling strict SSL mode while copying an otherwise default config; disabling hostname verification for self-signed certs but keeping verify-identity; migration from a config where the algorithm property was removed.","solutions":["Set quarkus.datasource.reactive.hostname-verification-algorithm=HTTPS (or another non-NONE algorithm) when using verify-identity","Lower ssl-mode to verify-ca or required if you intentionally do not want hostname verification","Remove the explicit NONE value and rely on defaults compatible with your chosen ssl-mode"],"exampleFix":"// before\nquarkus.datasource.db.reactive.mysql.ssl-mode=verify-identity\nquarkus.datasource.reactive.hostname-verification-algorithm=NONE\n// after\nquarkus.datasource.db.reactive.mysql.ssl-mode=verify-identity\nquarkus.datasource.reactive.hostname-verification-algorithm=HTTPS","handlingStrategy":"validation","validationCode":"if (\"verify-identity\".equals(sslMode)\n        && \"NONE\".equalsIgnoreCase(hostnameVerificationAlgorithm)) {\n    throw new IllegalStateException(\n        \"Set quarkus.datasource.reactive.hostname-verification-algorithm=HTTPS for verify-identity\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    recorder.mysqlConnectOptionsList(...);\n} catch (IllegalArgumentException e) {\n    log.error(\"Fix ssl-mode/hostname-verification-algorithm combination\");\n    throw e;\n}","preventionTips":["Pair verify-identity with an explicit algorithm (HTTPS)","Don't leave hostname-verification-algorithm=NONE in hardened configs","Review ssl-mode settings when promoting dev configs to prod"],"tags":["quarkus","mysql","ssl","hostname-verification","configuration"],"backgroundTag":"ssl-mode-hostname-verification-mismatch","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}