What causes "Failed to initialized SSL context" in quarkusio/quarkus?

Check the cause chain for NoSuchAlgorithmException vs KeyManagementException and fix the underlying JVM crypto config

quarkusio/quarkus · error · RuntimeException

Failed to initialized SSL context

Error message

Failed to initialized SSL context

What it means

Wraps NoSuchAlgorithmException or KeyManagementException raised while creating a trust-all SSLContext (TLS with a PassthroughTrustManager) when the 'trust all' option is enabled. The JVM rejected TLS context creation/initialization, so the builder cannot configure the insecure client and throws RuntimeException.

Source

Thrown at extensions/resteasy-classic/resteasy-client/runtime/src/main/java/io/quarkus/restclient/runtime/QuarkusRestClientBuilder.java:395

                .createProxy(aClass, actualClient, true, getLocalProviderInstances(), client));
    }

    private void configureTrustAll(ResteasyClientBuilder clientBuilder) {
        if (config == null) {
            return;
        }
        Optional<Boolean> trustAll = config.getOptionalValue(TLS_TRUST_ALL, Boolean.class);
        if (trustAll.isPresent() && trustAll.get()) {
            clientBuilder.hostnameVerifier(new NoopHostnameVerifier());
            try {
                if (this.sslContext == null) {
                    SSLContext sslContext = SSLContext.getInstance("TLS");
                    sslContext.init(null, new TrustManager[] { new PassthroughTrustManager() },
                            new SecureRandom());
                    clientBuilder.sslContext(sslContext);
                }
            } catch (NoSuchAlgorithmException | KeyManagementException e) {
                throw new RuntimeException("Failed to initialized SSL context", e);
            }
        }
    }

    @SuppressWarnings("unchecked")
    @Override
    public <T> T build(Class<T> aClass) throws IllegalStateException, RestClientDefinitionException {
        return build(aClass, null);
    }

    /**
     * Get the users list of proxy hosts. Translate list to regex format
     *
     * @return list of proxy hosts
     */
    private List<String> getProxyHostsAsRegex() {
        String noProxyHostsSysProps = System.getProperty("http.nonProxyHosts", null);
        if (noProxyHostsSysProps == null) {

View on GitHub (pinned to e1c734241f)

Solutions

Check the cause chain for NoSuchAlgorithmException vs KeyManagementException and fix the underlying JVM crypto config
Run on a standard JDK with default JCE providers; remove restrictive java.security overrides
Disable trust-all in production and configure a proper trust store (quarkus.rest-client.<key>.trust-store=...)
If on native image, ensure SSL/TLS native support is included (rebuild with the proper Quarkus SSL config)

Example fix

// before
quarkus.rest-client.my-client.trust-all=true  // fails on FIPS JVM
// after
quarkus.rest-client.my-client.trust-all=false
quarkus.rest-client.my-client.trust-store=/conf/truststore.p12
quarkus.rest-client.my-client.trust-store-password=secret

Defensive patterns

Strategy: try-catch

Validate before calling

// Verify TLS is creatable before enabling trust-all
try {
    SSLContext.getInstance("TLS").init(null, new TrustManager[] { tm }, new SecureRandom());
} catch (NoSuchAlgorithmException | KeyManagementException e) {
    throw new IllegalStateException("JVM cannot init TLS context; do not enable trust-all", e);
}

Try / catch

try {
    client = builder.build(MyClient.class);
} catch (RuntimeException e) {
    if (e.getMessage() != null && e.getMessage().contains("Failed to initialized SSL context")) {
        log.error("TLS init failed; check JCE providers/java.security", e.getCause());
    }
    throw e;
}

Prevention

Avoid trust-all in production; use an explicit trust store instead
Run on a standard JDK with default JCE providers
Audit custom java.security settings that replace the TLS provider
Test SSL config in the actual runtime image (including native builds)

When it happens

Trigger: Setting quarkus.rest-client.<key>.trust-all=true (or verifyHost=false paths using this code) and the JVM's TLS provider fails to init the SSLContext — e.g. restricted crypto policy, broken JCE providers, or custom SecureRandom/provider issues.

Common situations: Unusual JDKs (FIPS, stripped-down runtimes) lacking default TLS algorithm; exotic java.security settings overriding the TLS provider; native-image builds missing crypto natives.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/a9b2cf1124c6e1ad. Report an issue: GitHub.