eclipse-vertx/vert.x · error · VertxException

PQC enforcement policy ${pqcPolicy} requires PQ compliant na

Error message

PQC enforcement policy ${pqcPolicy} requires PQ compliant named groups but neither JDK nor OpenSSL support it

What it means

resolveEngineOptions throws VertxException when a PQC enforcement policy is required but no SSL engine at all can provide PQ-compliant named groups — neither the JDK nor the OpenSSL provider exposes them. There is no engine Vert.x can pick.

Source

Thrown at vertx-core/src/main/java/io/vertx/core/internal/tls/SslContextManager.java:110

        boolean pqcSupported;
        if (engineOptions instanceof JdkSSLEngineOptions) {
          pqcSupported = JdkSSLEngineOptions.isPqcAvailable();
        } else {
          pqcSupported = OpenSSLEngineOptions.isPqcAvailable();
        }
        if (!pqcSupported) {
          throw new VertxException("PQC enforcement policy " + pqcPolicy + " requires PQ compliant named groups but the configured SSL engine does not support it");
        }
      } else {
        // the user didn't specify any SSL engine, we pick one for them
        if (JdkSSLEngineOptions.isPqcAvailable()) {
          log.debug("JdkSslEngine supports PQ compliant groups, it will be used for the application");
          engineOptions = new JdkSSLEngineOptions();
        } else if (OpenSSLEngineOptions.isPqcAvailable()) {
          log.debug("OpenSslEngine supports PQ compliant groups, it will be used for the application");
          engineOptions = new OpenSSLEngineOptions();
        } else {
          throw new VertxException("PQC enforcement policy " + pqcPolicy + " requires PQ compliant named groups but neither JDK nor OpenSSL support it");
        }
      }
    }
    if (engineOptions == null) {
      if (useAlpn) {
        if (JdkSSLEngineOptions.isAlpnAvailable()) {
          engineOptions = new JdkSSLEngineOptions();
        } else if (OpenSSLEngineOptions.isAlpnAvailable()) {
          engineOptions = new OpenSSLEngineOptions();
        }
      }
    }
    if (engineOptions == null) {
      engineOptions = new JdkSSLEngineOptions();
    } else if (engineOptions instanceof OpenSSLEngineOptions) {
      if (!OpenSsl.isAvailable()) {
        VertxException ex = new VertxException("OpenSSL is not available");
        Throwable cause = OpenSsl.unavailabilityCause();

View on GitHub (pinned to fb308bd8c3)

Solutions

Upgrade the JDK (24+ has ML-KEM hybrid named groups) to make JdkSSLEngineOptions.isPqcAvailable() true.
Add/upgrade netty-tcnative with an OpenSSL/BoringSSL that supports PQ groups.
Relax or disable the PQC enforcement policy if legacy key exchange is acceptable.

Example fix

// before
mvn dependency: mvn 1.5.x tcnative (no PQ)
// after
<dependency>io.netty:netty-tcnative-boringssl-static:2.0.70+</dependency> // and JDK 24+

Defensive patterns

Strategy: validation

Validate before calling

if (pqcEnforced && !JdkSSLEngineOptions.isPqcAvailable() && !OpenSSLEngineOptions.isPqcAvailable()) {
  throw new IllegalStateException("No TLS engine with PQ named groups available on this runtime");
}

Try / catch

try { resolve(); } catch (VertxException e) { throw new IllegalStateException("PQC policy cannot be satisfied; upgrade JDK/OpenSSL", e); }

Prevention

Pin JDK 24+ (or a PQ-capable OpenSSL) in Dockerfiles before enabling PQC policies
Add a startup capability check that fails fast with an actionable message
Document the PQC policy's runtime requirements

When it happens

Trigger: PQC enforcement policy set, no explicit sslEngineOptions, and both JdkSSLEngineOptions.isPqcAvailable() and OpenSSLEngineOptions.isPqcAvailable() return false.

Common situations: Older JDK (no ML-KEM/hybrid groups) combined with netty-tcnative lacking PQ support, running with a strict PQC security policy on the client/server options.

Understand the failure class

Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.

Related errors

AI-assisted analysis of eclipse-vertx/vert.x@fb308bd8c3 (2026-09-06). Data as JSON: /api/errors/32911221da472ba7. Report an issue: GitHub.