quarkusio/quarkus · error · IllegalArgumentException

Key cert options have already been set

Error message

Key cert options have already been set

What it means

SSLConfigHelper.configureXxxKeyCertOptions methods install PEM/JKS/PFX key & certificate material onto Vert.x TCPSSLOptions. ensureKeyCertOptionsNotSet throws IllegalArgumentException if keyCertOptions was already set, preventing one key/cert source from silently replacing another.

Source

Thrown at extensions/grpc/runtime/src/main/java/io/quarkus/grpc/runtime/supports/SSLConfigHelper.java:119

    public static void configureJksKeyCertOptions(TCPSSLOptions options,
            GrpcClientConfiguration.TlsClientConfig.JksConfiguration configuration) {
        if (configuration.path().isPresent()) {
            ensureKeyCertOptionsNotSet(options);
            options.setKeyCertOptions(toJksOptions(configuration));
        }
    }

    public static void configurePfxKeyCertOptions(TCPSSLOptions options,
            GrpcClientConfiguration.TlsClientConfig.PfxConfiguration configuration) {
        if (configuration.path().isPresent()) {
            ensureKeyCertOptionsNotSet(options);
            options.setKeyCertOptions(toPfxOptions(configuration));
        }
    }

    private static void ensureKeyCertOptionsNotSet(TCPSSLOptions options) {
        if (options.getKeyCertOptions() != null) {
            throw new IllegalArgumentException("Key cert options have already been set");
        }
    }

    private SSLConfigHelper() {
        // Utility
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

1. Keep only one key/certificate configuration source for the given client/server
2. Delete the redundant key-store or key-certificate-* property
3. If both formats are needed for different clients, scope each under its own quarkus.grpc.clients.<name>.tls config

Example fix

// before
quarkus.grpc.servers.hello.tls.key-certificate-pem.keys=cert.key
quarkus.grpc.servers.hello.tls.key-store-jks.path=server.jks
// after
quarkus.grpc.servers.hello.tls.key-certificate-pem.keys=cert.key
quarkus.grpc.servers.hello.tls.key-certificate-pem.certs=cert.crt

if (options.getKeyCertOptions() != null) {
    throw new IllegalArgumentException("Choose one key/cert source: PEM, JKS or PFX");
}

try {
    SSLConfigHelper.configurePemKeyCertOptions(options, cfg);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("Key cert options")) {
        LOG.error("Key/cert set twice — remove the redundant keystore or PEM entry");
    }
    throw e;
}

When it happens

Trigger: Configuring both key-certificate-pem and key-store-jks (or pfx) for the same gRPC client/server TLS config; calling two configureXxxKeyCertOptions methods on the same TCPSSLOptions object.

Common situations: Having both tls.key-store and tls.certificate/key settings for one client; leftover config from a migration between PEM files and a keystore; programmatic setup followed by config application.

Related errors

• Trust options have already been set
• Unable to find the TLS configuration ${tlsConfigurationName}
• Unable to find the GrpcClientConfigProvider
• Unable to retrieve the gRPC Channel ${name}
• Failed to create Keycloak Admin client SSLContext

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/ccfe4fb3637e9b29. Report an issue: GitHub.