quarkusio/quarkus · critical · IllegalArgumentException

${baseUrl} requires SSL support but it is disabled. You prob

Error message

${baseUrl} requires SSL support but it is disabled. You probably have set quarkus.ssl.native to false.

What it means

When builder.baseUrl(new URL(...)) throws MalformedURLException whose message mentions the GraalVM native-image https flag, Quarkus rethrows this clearer error: the URL uses https but SSL support was compiled out of the native executable (quarkus.ssl.native=false or SSL disabled at build time).

Source

Thrown at extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/RestClientBase.java:302

        if (((baseUriFromAnnotation == null) || baseUriFromAnnotation.isEmpty()) && baseUrlOptional.isEmpty()) {
            String propertyPrefix = configKey != null ? configKey : proxyType.getName();
            throw new IllegalArgumentException(
                    String.format(
                            "Unable to determine the proper baseUrl/baseUri. " +
                                    "Consider registering using @RegisterRestClient(baseUri=\"someuri\"), @RegisterRestClient(configKey=\"orkey\"), "
                                    +
                                    "or by adding '%s' or '%s' to your Quarkus configuration",
                            String.format(QUARKUS_CONFIG_REST_URL_FORMAT, propertyPrefix),
                            String.format(QUARKUS_CONFIG_REST_URI_FORMAT, propertyPrefix)));
        }
        String baseUrl = baseUrlOptional.orElse(baseUriFromAnnotation);

        try {
            builder.baseUrl(new URL(baseUrl));
        } catch (MalformedURLException e) {
            if (e.getMessage().contains(
                    "It must be enabled by adding the --enable-url-protocols=https option to the native-image command")) {
                throw new IllegalArgumentException(baseUrl
                        + " requires SSL support but it is disabled. You probably have set quarkus.ssl.native to false.");
            }
            throw new IllegalArgumentException("The value of URL was invalid " + baseUrl, e);
        }
    }

    @SafeVarargs
    private static <T> Optional<T> oneOf(Optional<T>... optionals) {
        for (Optional<T> o : optionals) {
            if (o != null && o.isPresent()) {
                return o;
            }
        }
        return Optional.empty();
    }

    private static OptionalInt oneOf(OptionalInt... optionals) {
        for (OptionalInt o : optionals) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Remove quarkus.ssl.native=false so SSL is enabled in the native build (default is enabled when SSL is used)
2. Or keep it disabled and switch this client's URL to http:// only if the endpoint truly allows plaintext
3. Rebuild the native image after changing the flag — the fix cannot be applied at runtime
4. Set -H:EnableURLProtocols=https explicitly in native-image args if configuring manually

Example fix

// before (application.properties)
quarkus.ssl.native=false
quarkus.rest-client.secure-api.url=https://api.example.com
// after
quarkus.ssl.native=true
quarkus.rest-client.secure-api.url=https://api.example.com

// fail the build if SSL is disabled while any client uses https
boolean sslNative = Boolean.parseBoolean(System.getProperty("quarkus.ssl.native", "true"));
String url = "https://api.example.com";
if (!sslNative && url.startsWith("https://")) {
    throw new IllegalStateException("https URL used but quarkus.ssl.native=false");
}

When it happens

Trigger: Running a native-image build with https not in --enable-url-protocols; typically caused by setting quarkus.ssl.native=false while the REST client targets an https:// base URL.

Common situations: Teams disable SSL globally to shrink native binaries, then add an https client later; a base URL changed from http to https without revisiting native SSL config; CI builds with -Dquarkus.ssl.native=false optimizations.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Unsupported provider: ${provider}
• Cannot parse version from output: ${stringOutput}
• Not Implemented in native mode
• Unable to create new instance for ${clazz}
• .pfa font files are not supported. Use TrueType fonts, i.e.

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/d00eb9e3f16fc5cb. Report an issue: GitHub.