What causes "Failed to configure security provider '%s'" in quarkusio/quarkus?

Read the nested cause in the stack trace — it comes from Provider.configure().

quarkusio/quarkus · error · ConfigurationException

quarkus.security.security-provider-config.<providerName>

quarkus.security.security-provider-config.<providerName>

Error message

Failed to configure security provider '%s'

What it means

After locating the provider, configureProvider() calls provider.configure(providerConfig) for each entry in quarkus.security.security-provider-config.<providerName>. If configuration fails (bad config file syntax, missing file, provider rejects the settings) the exception is wrapped in a ConfigurationException keyed to that property, failing startup.

Source

Thrown at extensions/security/runtime/src/main/java/io/quarkus/security/runtime/SecurityProviderRecorder.java:37

@Recorder
public class SecurityProviderRecorder {

    private static final Logger LOG = Logger.getLogger(SecurityProviderRecorder.class);

    public void configureProvider(String providerName, List<String> providerConfigs) {
        Provider provider = Security.getProvider(providerName);
        if (provider == null) {
            throw new ConfigurationException(
                    String.format("Security provider '%s' is not available", providerName),
                    Set.of("quarkus.security.security-providers"));
        }
        for (String providerConfig : providerConfigs) {
            try {
                Provider configured = provider.configure(providerConfig);
                LOG.debugf("Registering security provider: %s (configured from %s)", configured.getName(), providerConfig);
                SecurityProviderUtils.addProvider(configured);
            } catch (Exception e) {
                throw new ConfigurationException(
                        String.format("Failed to configure security provider '%s'", providerName), e,
                        Set.of("quarkus.security.security-provider-config." + providerName));
            }
        }
    }

    public void addBouncyCastleProvider(boolean inFipsMode) {
        final String providerName = inFipsMode ? SecurityProviderUtils.BOUNCYCASTLE_FIPS_PROVIDER_CLASS_NAME
                : SecurityProviderUtils.BOUNCYCASTLE_PROVIDER_CLASS_NAME;
        addProvider(loadProvider(providerName));
    }

    public void addBouncyCastleJsseProvider() {
        Provider bc = loadProvider(SecurityProviderUtils.BOUNCYCASTLE_PROVIDER_CLASS_NAME);
        Provider bcJsse = loadProvider(SecurityProviderUtils.BOUNCYCASTLE_JSSE_PROVIDER_CLASS_NAME);
        int sunJsseIndex = findProviderIndex(SecurityProviderUtils.SUN_JSSE_PROVIDER_NAME);
        insertProvider(bc, sunJsseIndex);
        insertProvider(bcJsse, sunJsseIndex + 1);

View on GitHub (pinned to e1c734241f)

Solutions

Read the nested cause in the stack trace — it comes from Provider.configure().
Verify the config file path is correct and readable by the application process.
Validate the config content against the provider's documented format/version.
Remove the config property to boot with the unconfigured provider and add configuration incrementally.
Upgrade or align the provider dependency with the config format you are using.

Example fix

# before
quarkus.security.security-provider-config.BC=bc-provider.cnf
# after (correct path/format)
quarkus.security.security-provider-config.BC=/etc/quarkus/bc-provider.config

Defensive patterns

Strategy: validation

Validate before calling

// validate the provider config before boot
File cfg = new File("/etc/quarkus/bc-provider.config");
if (!cfg.isFile() || !cfg.canRead()) {
    throw new IllegalStateException("Provider config file missing or unreadable");
}

Try / catch

try {
    provider.configure(providerConfig);
} catch (Exception e) {
    throw new IllegalStateException("Invalid security provider config: " + providerConfig, e);
}

Prevention

Check config file paths and read permissions before packaging
Validate config content against the provider version's supported format
Roll out provider config changes incrementally (boot without config first)
Pin the provider dependency version to the documented config format

When it happens

Trigger: Setting quarkus.security.security-provider-config.<providerName>=<path-or-config> where the referenced configuration cannot be applied by Provider.configure() — unreadable file, malformed content, or provider-specific rejection.

Common situations: Typo in the config file path; config file exists but contains directives the provider version doesn't support; insufficient file permissions; provider expects a different config format.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/4e09180161aa9b8e. Report an issue: GitHub.