quarkusio/quarkus · error · java.lang.IllegalArgumentException

quarkus.datasource.reactive.hostname-verification-algorithm

Error message

quarkus.datasource.reactive.hostname-verification-algorithm must be specified under verify-full sslmode

What it means

PgPoolRecorder.toPgConnectOptions validates that hostname verification is performed when ssl-mode=verify-full. PostgreSQL's SslMode.VERIFY_FULL requires a hostname verification algorithm; if quarkus.datasource.reactive.hostname-verification-algorithm is NONE, the recorder throws IllegalArgumentException since certificate identity checking would be skipped.

Source

Thrown at extensions/reactive-pg-client/runtime/src/main/java/io/quarkus/reactive/pg/client/runtime/PgPoolRecorder.java:124

            pgConnectOptionsList.add(new PgConnectOptions());
        }

        pgConnectOptionsList.forEach(pgConnectOptions -> {
            ReactivePoolUtil.configureCredentials(pgConnectOptions, dataSourceRuntimeConfig);

            ReactivePoolUtil.configurePreparedStatementCache(pgConnectOptions, dataSourceReactiveRuntimeConfig);

            if (dataSourceReactivePostgreSQLConfig.pipeliningLimit().isPresent()) {
                pgConnectOptions.setPipeliningLimit(dataSourceReactivePostgreSQLConfig.pipeliningLimit().getAsInt());
            }

            if (dataSourceReactivePostgreSQLConfig.sslMode().isPresent()) {
                final SslMode sslMode = dataSourceReactivePostgreSQLConfig.sslMode().get();
                pgConnectOptions.setSslMode(sslMode);

                var algo = dataSourceReactiveRuntimeConfig.hostnameVerificationAlgorithm();
                if ("NONE".equalsIgnoreCase(algo) && sslMode == SslMode.VERIFY_FULL) {
                    throw new IllegalArgumentException(
                            "quarkus.datasource.reactive.hostname-verification-algorithm must be specified under verify-full sslmode");
                }
            } else if (dataSourceReactiveRuntimeConfig.tlsConfigurationName().isPresent()) {
                // Auto-enable SSL mode when a named TLS configuration is set
                pgConnectOptions.setSslMode(SslMode.REQUIRE);
            }

            if (dataSourceReactivePostgreSQLConfig.sslNegotiation().isPresent()) {
                pgConnectOptions.setSslNegotiation(dataSourceReactivePostgreSQLConfig.sslNegotiation().get());
            }

            pgConnectOptions.setUseLayer7Proxy(dataSourceReactivePostgreSQLConfig.useLayer7Proxy());

            ReactivePoolUtil.configureSsl(pgConnectOptions, dataSourceReactiveRuntimeConfig, tlsRegistry);

            dataSourceReactiveRuntimeConfig.additionalProperties().forEach(pgConnectOptions::addProperty);

            // Use the convention defined by Quarkus Micrometer Vert.x metrics to create metrics prefixed with postgresql.

View on GitHub (pinned to e1c734241f)

Solutions

1. Set quarkus.datasource.reactive.hostname-verification-algorithm=HTTPS when ssl-mode=verify-full
2. Use ssl-mode=verify-ca instead if hostname verification is intentionally undesired
3. Audit all datasource configs (per-datasource overrides) so none pair verify-full with NONE

Example fix

// before
quarkus.datasource.db.reactive.postgresql.ssl-mode=verify-full
quarkus.datasource.reactive.hostname-verification-algorithm=NONE
// after
quarkus.datasource.db.reactive.postgresql.ssl-mode=verify-full
quarkus.datasource.reactive.hostname-verification-algorithm=HTTPS

if ("verify-full".equals(sslMode)
        && "NONE".equalsIgnoreCase(hostnameVerificationAlgorithm)) {
    throw new IllegalStateException(
        "Set quarkus.datasource.reactive.hostname-verification-algorithm=HTTPS for verify-full");
}

try {
    recorder.pgConnectOptionsList(...);
} catch (IllegalArgumentException e) {
    log.error("Fix ssl-mode/hostname-verification-algorithm combination");
    throw e;
}

When it happens

Trigger: Setting quarkus.datasource."x".reactive.postgresql.ssl-mode=verify-full while quarkus.datasource.reactive.hostname-verification-algorithm=NONE (or left at default NONE).

Common situations: Hardening a Postgres connection to verify-full without updating the algorithm property; keeping an old NONE setting from a dev environment when moving to production TLS.

Related errors

• quarkus.datasource.reactive.hostname-verification-algorithm
• Trust options have already been set
• Key cert options have already been set
• Failed to load application configuration
• Failed to initialize application configuration

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/982b3068a7a84a9d. Report an issue: GitHub.