quarkusio/quarkus · error · RuntimeException

Failed to create SSLContext

Error message

Failed to create SSLContext

What it means

OidcTlsSupport.getSslContext() delegates to the TLS registry (tlsConfig.createSSLContext()) and wraps any exception as 'Failed to create SSLContext'. It indicates the TLS registry could not build an SSLContext from the configured key store/trust store material for mTLS or secure OIDC connections.

Source

Thrown at extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcTlsSupport.java:88

        public boolean useTlsRegistry() {
            return tlsConfig != null;
        }

        public TlsConfiguration getTlsConfig() {
            return tlsConfig;
        }

        public boolean isGlobalTrustAll() {
            return globalTrustAll;
        }

        public SSLContext getSslContext() {
            if (useTlsRegistry()) {
                try {
                    return tlsConfig.createSSLContext();
                } catch (Exception e) {
                    throw new RuntimeException("Failed to create SSLContext", e);
                }
            }
            return null;
        }

        public boolean useTlsRegistryAndMtls() {
            return useTlsRegistry() && tlsConfig.getKeyStoreOptions() != null;
        }

        public String getTlsConfigName() {
            return tlsConfigName;
        }
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

1. Check the 'Caused by' chain for the underlying TLS registry failure (missing/corrupt store, wrong password)
2. Verify quarkus.tls.* key-store and trust-store files exist and passwords/formats are correct
3. Test store loading independently with keytool/openssl
4. If not using the TLS registry, configure OIDC connection security via the classic oidc tls configuration instead

Example fix

// before
quarkus.tls.key-store.path=/etc/certs/keystore.p12
quarkus.tls.key-store.password=wrongpass
// after
quarkus.tls.key-store.path=/etc/certs/keystore.p12
quarkus.tls.key-store.password=correct-secret
quarkus.tls.key-store.type=PKCS12

// validate store files exist before startup
for (String p : List.of(keyStorePath, trustStorePath)) {
    if (!Files.exists(Path.of(p))) throw new IllegalStateException("Missing TLS store: " + p);
}

try {
    SSLContext ctx = support.getSslContext();
} catch (RuntimeException e) {
    Throwable cause = e.getCause();
    log.errorf("TLS registry failed to build SSLContext: %s", cause == null ? e : cause.getMessage());
    throw e;
}

When it happens

Trigger: Calling getSslContext() when useTlsRegistry() is true and tlsConfig.createSSLContext() throws — e.g. invalid keystore path/password, unsupported key format, missing store files.

Common situations: Wrong quarkus.tls.key-store/trust-store credentials or file paths; PKCS12/JKS format mismatch; missing BouncyCastle for exotic formats; certificate expired.

Related errors

• Trust options have already been set
• Key cert options have already been set
• Unable to find the TLS configuration ${tlsConfigurationName}
• Failed to create Keycloak Admin client SSLContext
• Hostname verification failure

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/11e62d09141237ca. Report an issue: GitHub.