quarkusio/quarkus · error · UnsupportedOperationException

JDK provider does not support %s protocol

Error message

JDK provider does not support %s protocol

What it means

The JDK SSL provider only implements a subset of Netty's application protocol negotiation protocols (ALPN and NPN are supported; NONE or other values are not). The default branch of toNegotiator's protocol switch throws UnsupportedOperationException naming the unsupported protocol.

Source

Thrown at extensions/netty/runtime/src/main/java/io/quarkus/netty/runtime/graal/NettySubstitutions.java:381

                        return new JdkAlpnApplicationProtocolNegotiator(false, config.supportedProtocols());
                    } else {
                        throw new UnsupportedOperationException(new StringBuilder("JDK provider does not support ")
                                .append(config.selectorFailureBehavior()).append(" failure behavior").toString());
                    }
                } else {
                    switch (config.selectedListenerFailureBehavior()) {
                        case ACCEPT:
                            return new JdkAlpnApplicationProtocolNegotiator(false, config.supportedProtocols());
                        case FATAL_ALERT:
                            return new JdkAlpnApplicationProtocolNegotiator(true, config.supportedProtocols());
                        default:
                            throw new UnsupportedOperationException(new StringBuilder("JDK provider does not support ")
                                    .append(config.selectedListenerFailureBehavior()).append(" failure behavior")
                                    .toString());
                    }
                }
            default:
                throw new UnsupportedOperationException(
                        new StringBuilder("JDK provider does not support ").append(config.protocol())
                                .append(" protocol")
                                .toString());
        }
    }

}

@TargetClass(className = "io.netty.bootstrap.FailedChannel")
final class Target_io_netty_bootstrap_FailedChannel {

    @Alias
    Target_io_netty_bootstrap_FailedChannel() {
    }
}

/*
 * This one only prints exceptions otherwise we get a useless bogus

View on GitHub (pinned to e1c734241f)

Solutions

1. Set the ApplicationProtocolConfig protocol to ALPN (or NPN) when using the JDK provider.
2. Pass null instead of an ApplicationProtocolConfig when no negotiation is desired.
3. Use the OpenSSL provider if a protocol the JDK cannot negotiate is required.

Example fix

// before
ApplicationProtocolConfig apn = new ApplicationProtocolConfig(
    ApplicationProtocolConfig.Protocol.NONE,
    ApplicationProtocolConfig.SelectorFailureBehavior.FATAL_ALERT,
    ApplicationProtocolConfig.SelectedListenerFailureBehavior.FATAL_ALERT,
    Collections.emptyList());
// after
ApplicationProtocolConfig apn = new ApplicationProtocolConfig(
    ApplicationProtocolConfig.Protocol.ALPN,
    ApplicationProtocolConfig.SelectorFailureBehavior.NO_ADVERTISE,
    ApplicationProtocolConfig.SelectedListenerFailureBehavior.FATAL_ALERT,
    List.of("h2", "http/1.1"));

if (config.protocol() != ApplicationProtocolConfig.Protocol.ALPN
        && config.protocol() != ApplicationProtocolConfig.Protocol.NPN) {
    throw new IllegalArgumentException("JDK provider supports only ALPN/NPN, got " + config.protocol());
}

try {
    ctx = builder.build();
} catch (UnsupportedOperationException e) {
    if (e.getMessage().contains("protocol")) {
        ctx = rebuildWithAlpnProtocol();
    } else { throw e; }
}

When it happens

Trigger: Building an SslContext with SslProvider.JDK and an ApplicationProtocolConfig whose protocol() is not ALPN/NPN (e.g. Protocol.NONE, or an unhandled enum value) — in native image via the Quarkus Netty substitution.

Common situations: Passing ApplicationProtocolConfig.EMPTY / Protocol.NONE while still requesting a negotiator; refactor from deprecated ApplicationProtocolUtil defaults; JDK provider used where OpenSSL-specific protocol config was intended.

Related errors

• JDK provider does not support %s failure behavior
• Unsupported provider: ${provider}
• OCSP is not supported with this SslProvider:
• Quarkus applications require Java 21 or higher to build
• No system java compiler provided

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/47910e7b1b146f39. Report an issue: GitHub.