quarkusio/quarkus · error · IllegalArgumentException

OCSP is not supported with this SslProvider:

Error message

OCSP is not supported with this SslProvider: 

What it means

Netty's JDK (non-OpenSSL) SSL provider cannot perform OCSP stapling. This Quarkus native-image substitution of Netty's JdkSslServerContext creation path checks the enableOcsp flag and throws IllegalArgumentException when OCSP is requested with a provider that cannot support it, instead of silently ignoring the option.

Source

Thrown at extensions/netty/runtime/src/main/java/io/quarkus/netty/runtime/graal/NettySubstitutions.java:273

    }
}

@TargetClass(className = "io.netty.handler.ssl.SslContext")
final class Target_io_netty_handler_ssl_SslContext {

    @Substitute
    static SslContext newServerContextInternal(SslProvider provider,
            Provider sslContextProvider,
            X509Certificate[] trustCertCollection, TrustManagerFactory trustManagerFactory,
            X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
            Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn,
            long sessionCacheSize, long sessionTimeout, ClientAuth clientAuth, String[] protocols, boolean startTls,
            boolean enableOcsp, SecureRandom secureRandom, String keyStoreType,
            Map.Entry<SslContextOption<?>, Object>[] ctxOptions,
            List<OpenSslCredential> credentials) throws SSLException {
        if (enableOcsp) {
            throw new IllegalArgumentException("OCSP is not supported with this SslProvider: " + provider);
        }
        Target_io_netty_handler_ssl_ResumptionController resumptionController = new Target_io_netty_handler_ssl_ResumptionController();
        return (SslContext) (Object) new Target_io_netty_handler_ssl_JdkSslServerContext(sslContextProvider,
                trustCertCollection, trustManagerFactory, keyCertChain, key, keyPassword,
                keyManagerFactory, ciphers, cipherFilter, apn, sessionCacheSize, sessionTimeout,
                clientAuth, protocols, startTls, secureRandom, keyStoreType, resumptionController);
    }

    @Substitute
    static SslContext newClientContextInternal(SslProvider provider,
            Provider sslContextProvider,
            X509Certificate[] trustCert, TrustManagerFactory trustManagerFactory,
            X509Certificate[] keyCertChain, PrivateKey key, String keyPassword, KeyManagerFactory keyManagerFactory,
            Iterable<String> ciphers, CipherSuiteFilter cipherFilter, ApplicationProtocolConfig apn, String[] protocols,
            long sessionCacheSize, long sessionTimeout, boolean enableOcsp,
            SecureRandom secureRandom, String keyStoreType, String endpointIdentificationAlgorithm,
            List<SNIServerName> serverNames,
            Map.Entry<SslContextOption<?>, Object>[] options,

View on GitHub (pinned to e1c734241f)

Solutions

1. Disable OCSP: pass enableOcsp=false / remove the ENABLE_OCSP SslContextOption.
2. Use the OpenSSL (netty-tcnative) provider, e.g. SslProvider.OPENSSL_REFCNT, which supports OCSP.
3. Verify which SslProvider is actually selected at runtime and align your OCSP expectations with it.

Example fix

// before
SslContext ctx = SslContextBuilder.forServer(keyCertChain, key)
        .sslProvider(SslProvider.JDK)
        .startTls(true)
        .option(SslContextOption.ENABLE_OCSP, true)
        .build();
// after
SslContext ctx = SslContextBuilder.forServer(keyCertChain, key)
        .sslProvider(SslProvider.OPENSSL_REFCNT) // OCSP-capable provider
        .startTls(true)
        .option(SslContextOption.ENABLE_OCSP, true)
        .build();

if (enableOcsp && provider == SslProvider.JDK) {
    throw new IllegalArgumentException("OCSP requires the OpenSSL provider, not JDK");
}

try {
    SslContext ctx = builder.build();
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("OCSP is not supported")) {
        ctx = builder.option(SslContextOption.ENABLE_OCSP, false).build();
    } else { throw e; }
}

When it happens

Trigger: Building/running a native-image Quarkus app where SslContextBuilder is used to create a server SSL context with SslContextOption.ENABLE_OCSP (or the enableOcsp parameter) set to true while the provider is the JDK/JDK-default SslProvider rather than OpenSSL.

Common situations: Enabling OCSP stapling in Netty TLS configuration while running on the JDK SSL provider; Quarkus native mode where the OpenSSL provider is unavailable so the JDK substitution path is used; copying OpenSSL-provider config code onto the JDK provider.

Related errors

• Could not find Jetty NPN/ALPN or Conscrypt as installed JDK
• Unsupported provider: ${provider}
• Unable to create default SSLContext
• Trust options have already been set
• Key cert options have already been set

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/c82ec1a339e5748f. Report an issue: GitHub.