quarkusio/quarkus · error · IllegalStateException

Invalid configuration: `quarkus.management.port` must be dif

Error message

Invalid configuration: `quarkus.management.port` must be different from `quarkus.http.ssl-port`.

What it means

VertxHttpRecorder also validates that the management port does not equal the resolved HTTPS port (quarkus.http.ssl-port); when both servers would bind the same port, startup fails with this IllegalStateException. Like the HTTP check, random ports (0) are not validated.

Source

Thrown at extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/VertxHttpRecorder.java:1155

        if (!managementBuildTimeConfig.enabled() || managementConfig == null || !managementConfig.hostEnabled()) {
            return;
        }

        int managementPort = managementConfig.determinePort(launchMode);
        if (managementPort <= 0) {
            // 0 means random port, so it can't be validated against fixed ports here
            return;
        }

        int httpPort = httpConfig.hostEnabled() ? httpConfig.determinePort(launchMode) : -1;
        if (httpPort > 0 && httpPort == managementPort) {
            throw new IllegalStateException(
                    "Invalid configuration: `quarkus.management.port` must be different from `quarkus.http.port`.");
        }

        int httpsPort = httpConfig.determineSslPort(launchMode);
        if (httpsPort > 0 && httpsPort == managementPort) {
            throw new IllegalStateException(
                    "Invalid configuration: `quarkus.management.port` must be different from `quarkus.http.ssl-port`.");
        }
    }

    private static void setHttpServerTiming(boolean httpDisabled, HttpServerConfig httpServerConfig,
            HttpServerConfig sslConfig,
            HttpServerConfig domainSocketConfig, boolean auxiliaryApplication, HttpServerConfig managementConfig) {
        StringBuilder serverListeningMessage = new StringBuilder("Listening on: ");
        int socketCount = 0;

        if (!httpDisabled && httpServerConfig != null) {
            serverListeningMessage.append(String.format(
                    "http://%s:%s", getDeveloperFriendlyHostName(httpServerConfig), actualHttpPort));
            socketCount++;
        }

        if (sslConfig != null) {
            if (socketCount > 0) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Set quarkus.management.port to a value different from quarkus.http.ssl-port
2. Or set quarkus.management.port=0 for a random port
3. Review active profile and env vars that could set ssl-port equal to the management port

Example fix

// before
quarkus.http.ssl-port=8443
quarkus.management.port=8443
// after
quarkus.http.ssl-port=8443
quarkus.management.port=9001

if (managementPort > 0 && managementPort == sslPort) {
    throw new IllegalStateException("quarkus.management.port must differ from quarkus.http.ssl-port");
}

When it happens

Trigger: quarkus.management.port equals the value resolved from quarkus.http.ssl-port (both positive) while the management interface is enabled and SSL is configured.

Common situations: Same numeric value for management.port and http.ssl-port; TLS setup where the management interface inherited the HTTPS port; profile or env overrides making ssl-port coincide with the management port.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Invalid configuration: `quarkus.management.port` must be dif
• The 'quarkus.hibernate-orm.mapping.format.global' configurat
• Failed to create Keycloak Admin client SSLContext
• Either 'quarkus.oidc-client.auth-server-url' or absolute 'qu
• The OIDC proxy configuration currently does not support the

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/bdf08777d8d2e7a9. Report an issue: GitHub.