quarkusio/quarkus · error · java.lang.IllegalArgumentException

quarkus.datasource.reactive.hostname-verification-algorithm

Error message

quarkus.datasource.reactive.hostname-verification-algorithm must be specified under verify-identity sslmode

What it means

MySQLPoolRecorder.toMySQLConnectOptions validates that hostname verification is actually performed when ssl-mode=verify-identity. Vert.x's MySQL SslMode.VERIFY_IDENTITY requires an algorithm (e.g. HTTPS); if quarkus.datasource.reactive.hostname-verification-algorithm is NONE, the recorder throws IllegalArgumentException because identity would never be verified.

Source

Thrown at extensions/reactive-mysql-client/runtime/src/main/java/io/quarkus/reactive/mysql/client/runtime/MySQLPoolRecorder.java:166

            if (dataSourceReactiveMySQLConfig.serverRsaPublicKeyValue().isPresent()) {
                mysqlConnectOptions
                        .setServerRsaPublicKeyValue(
                                Buffer.buffer(dataSourceReactiveMySQLConfig.serverRsaPublicKeyValue().get()));
            }

            if (dataSourceReactiveMySQLConfig.pipeliningLimit().isPresent()) {
                mysqlConnectOptions.setPipeliningLimit(dataSourceReactiveMySQLConfig.pipeliningLimit().getAsInt());
            }

            dataSourceReactiveMySQLConfig.useAffectedRows().ifPresent(mysqlConnectOptions::setUseAffectedRows);

            if (dataSourceReactiveMySQLConfig.sslMode().isPresent()) {
                final SslMode sslMode = dataSourceReactiveMySQLConfig.sslMode().get();
                mysqlConnectOptions.setSslMode(sslMode);

                var algo = dataSourceReactiveRuntimeConfig.hostnameVerificationAlgorithm();
                if ("NONE".equalsIgnoreCase(algo) && sslMode == SslMode.VERIFY_IDENTITY) {
                    throw new IllegalArgumentException(
                            "quarkus.datasource.reactive.hostname-verification-algorithm must be specified under verify-identity sslmode");
                }
            } else if (dataSourceReactiveRuntimeConfig.tlsConfigurationName().isPresent()) {
                // Auto-enable SSL mode when a named TLS configuration is set
                mysqlConnectOptions.setSslMode(SslMode.REQUIRED);
            }

            dataSourceReactiveMySQLConfig.authenticationPlugin().ifPresent(mysqlConnectOptions::setAuthenticationPlugin);

            ReactivePoolUtil.configureSsl(mysqlConnectOptions, dataSourceReactiveRuntimeConfig, tlsRegistry);

            dataSourceReactiveRuntimeConfig.additionalProperties().forEach(mysqlConnectOptions::addProperty);

            // Use the convention defined by Quarkus Micrometer Vert.x metrics to create metrics prefixed with mysql.
            // and the client_name as tag.
            // See io.quarkus.micrometer.runtime.binder.vertx.VertxMeterBinderAdapter.extractPrefix and
            // io.quarkus.micrometer.runtime.binder.vertx.VertxMeterBinderAdapter.extractClientName
            mysqlConnectOptions.setMetricsName("mysql|" + dataSourceName);

View on GitHub (pinned to e1c734241f)

Solutions

1. Set quarkus.datasource.reactive.hostname-verification-algorithm=HTTPS (or another non-NONE algorithm) when using verify-identity
2. Lower ssl-mode to verify-ca or required if you intentionally do not want hostname verification
3. Remove the explicit NONE value and rely on defaults compatible with your chosen ssl-mode

Example fix

// before
quarkus.datasource.db.reactive.mysql.ssl-mode=verify-identity
quarkus.datasource.reactive.hostname-verification-algorithm=NONE
// after
quarkus.datasource.db.reactive.mysql.ssl-mode=verify-identity
quarkus.datasource.reactive.hostname-verification-algorithm=HTTPS

if ("verify-identity".equals(sslMode)
        && "NONE".equalsIgnoreCase(hostnameVerificationAlgorithm)) {
    throw new IllegalStateException(
        "Set quarkus.datasource.reactive.hostname-verification-algorithm=HTTPS for verify-identity");
}

try {
    recorder.mysqlConnectOptionsList(...);
} catch (IllegalArgumentException e) {
    log.error("Fix ssl-mode/hostname-verification-algorithm combination");
    throw e;
}

When it happens

Trigger: Configuring quarkus.datasource."x".reactive.mysql.ssl-mode=verify-identity together with quarkus.datasource.reactive.hostname-verification-algorithm=NONE (or leaving it at its NONE default).

Common situations: Enabling strict SSL mode while copying an otherwise default config; disabling hostname verification for self-signed certs but keeping verify-identity; migration from a config where the algorithm property was removed.

Related errors

• quarkus.datasource.reactive.hostname-verification-algorithm
• Trust options have already been set
• Key cert options have already been set
• Failed to load application configuration
• Failed to initialize application configuration

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/f78478c6753e5b04. Report an issue: GitHub.