What causes "Security provider '%s' is not available" in quarkusio/quarkus?

Add the provider dependency (e.g. org.bouncycastle:bcprov-jdk18on) to the project.

quarkusio/quarkus · error · ConfigurationException

quarkus.security.security-providers

quarkus.security.security-providers

Error message

Security provider '%s' is not available

What it means

SecurityProviderRecorder.configureProvider() resolves a JCA security Provider by name from Security.getProvider() when registering providers configured via quarkus.security.security-providers. If the JVM does not know a provider with that name, a SmallRye ConfigurationException is thrown at startup listing the quarkus.security.security-providers property, aborting application boot.

Source

Thrown at extensions/security/runtime/src/main/java/io/quarkus/security/runtime/SecurityProviderRecorder.java:27

import java.security.Provider;
import java.security.Security;
import java.util.List;
import java.util.Set;

import org.jboss.logging.Logger;

import io.quarkus.runtime.annotations.Recorder;
import io.quarkus.runtime.configuration.ConfigurationException;

@Recorder
public class SecurityProviderRecorder {

    private static final Logger LOG = Logger.getLogger(SecurityProviderRecorder.class);

    public void configureProvider(String providerName, List<String> providerConfigs) {
        Provider provider = Security.getProvider(providerName);
        if (provider == null) {
            throw new ConfigurationException(
                    String.format("Security provider '%s' is not available", providerName),
                    Set.of("quarkus.security.security-providers"));
        }
        for (String providerConfig : providerConfigs) {
            try {
                Provider configured = provider.configure(providerConfig);
                LOG.debugf("Registering security provider: %s (configured from %s)", configured.getName(), providerConfig);
                SecurityProviderUtils.addProvider(configured);
            } catch (Exception e) {
                throw new ConfigurationException(
                        String.format("Failed to configure security provider '%s'", providerName), e,
                        Set.of("quarkus.security.security-provider-config." + providerName));
            }
        }
    }

    public void addBouncyCastleProvider(boolean inFipsMode) {
        final String providerName = inFipsMode ? SecurityProviderUtils.BOUNCYCASTLE_FIPS_PROVIDER_CLASS_NAME

View on GitHub (pinned to e1c734241f)

Solutions

Add the provider dependency (e.g. org.bouncycastle:bcprov-jdk18on) to the project.
Verify the provider name spelled in quarkus.security.security-providers is one available to Security.getProvider() in your JVM.
Alternatively configure the provider class so Quarkus loads/registers it itself (SecurityProviderUtils.loadProvider path / provider-config).
Check the Quarkus version's migration notes if upgrading — the property name changed from quarkus.security.providers.

Example fix

# before
quarkus.security.security-providers=BC
# after: add dependency
# <dependency>org.bouncycastle:bcprov-jdk18on</dependency>
quarkus.security.security-providers=BC

Defensive patterns

Strategy: validation

Validate before calling

// before boot, verify the provider resolves
Provider p = Security.getProvider("BC");
if (p == null) {
    throw new IllegalStateException("Add org.bouncycastle:bcprov-jdk18on to dependencies");
}

Try / catch

try {
    application.start();
} catch (ConfigurationException e) {
    if (String.valueOf(e.getConfigProperties()).contains("security-providers")) {
        log.error("Provider missing: add its JAR dependency or fix quarkus.security.security-providers", e);
    }
}

Prevention

Verify provider availability with Security.getProvider(name) before configuring it
Add provider artifacts (e.g. BouncyCastle) as compile/runtime dependencies
After Quarkus upgrades, check whether the property was renamed (providers -> security-providers)
Keep provider names in one configuration place to avoid typos

When it happens

Trigger: Listing a provider name in quarkus.security.security-providers (e.g. BC, BCFSKG) that is not registered with the JDK's Security framework — typically because the provider JAR (e.g. BouncyCastle) is not on the classpath or is not itself registered.

Common situations: Quarkus 3.x moved from quarkus.security.providers to quarkus.security.security-providers and to loading provider classes rather than relying on pre-registered names; BouncyCastle dependency missing; provider name misspelled; native-image where the provider was not initialized.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/a3e7aab09451e8b9. Report an issue: GitHub.