quarkusio/quarkus · error · ConfigurationException

Security provider %s can not be added

Error message

Security provider %s can not be added

What it means

SecurityProviderUtils.addProvider() registers a Provider with the JVM via Security.addProvider(), but only if a provider with the same name is not already present. If Security.addProvider() (or the preceding check) throws, the exception is wrapped in a ConfigurationException saying the provider cannot be added, failing startup.

Source

Thrown at extensions/security/runtime/src/main/java/io/quarkus/security/runtime/SecurityProviderUtils.java:39

    public static final Map<String, String> SUN_PROVIDERS = Map.of("SunPKCS11", "sun.security.pkcs11.SunPKCS11");

    private SecurityProviderUtils() {

    }

    public static void addProvider(String provider) {
        addProvider(loadProvider(provider));
    }

    public static void addProvider(Provider provider) {
        try {
            if (Security.getProvider(provider.getName()) == null) {
                Security.addProvider(provider);
            }
        } catch (Exception t) {
            final String errorMessage = String.format("Security provider %s can not be added", provider.getName());
            throw new ConfigurationException(errorMessage, t);
        }
    }

    public static void insertProvider(Provider provider, int index) {
        try {
            if (Security.getProvider(provider.getName()) == null) {
                Security.insertProviderAt(provider, index);
            }
        } catch (Exception t) {
            final String errorMessage = String.format("Security provider %s can not be inserted", provider.getName());
            throw new ConfigurationException(errorMessage, t);
        }
    }

    public static Provider loadProvider(String providerClassName) {
        try {
            return (Provider) Thread.currentThread().getContextClassLoader().loadClass(providerClassName)
                    .getDeclaredConstructor().newInstance();

View on GitHub (pinned to e1c734241f)

Solutions

1. Read the wrapped cause t in the ConfigurationException stack trace.
2. Check whether a provider with the same name is already registered (Security.getProviders()) — the utility intentionally skips duplicates; an exception means a different problem.
3. Ensure the provider is loaded by the correct (application) classloader.
4. Remove any SecurityManager / grant the required SecurityPermission("insertProvider.") if a policy blocks registration.
5. Upgrade the provider library if registration fails due to a bug in the Provider implementation.

Example fix

// before: registering manually then letting Quarkus register too
Security.addProvider(new BouncyCastleProvider()); // duplicate/conflict
// after: let Quarkus manage it
quarkus.security.security-providers=BC

// avoid duplicate registration and check environment first
if (Security.getProvider(provider.getName()) == null) {
    SecurityManager sm = System.getSecurityManager();
    if (sm != null) sm.checkSecurityAccess("insertProvider." + provider.getName());
}

try {
    SecurityProviderUtils.addProvider(provider);
} catch (ConfigurationException e) {
    log.warnf(e, "Provider %s not registered; falling back to existing providers", provider.getName());
}

When it happens

Trigger: Runtime registration of a configured security provider where Security.addProvider() throws — e.g. a SecurityManager denies insertion, the provider name collides and the check throws, or the Provider is in a broken state.

Common situations: Native-image or restricted environments where Security provider registration is limited; duplicate provider registration race from two startup paths; provider class loaded by the wrong classloader so its internals fail during registration; running under a SecurityManager policy that blocks Security.addProvider.

Related errors

• quarkus.security.security-providers
• quarkus.security.security-provider-config.<providerName>
• Security provider %s can not be inserted
• CDI container is not available, cannot initialize HTTP Secur
• No producers for required item %s, step builder used: %s

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/e9df55d2ea99284f. Report an issue: GitHub.