quarkusio/quarkus · error · UnsupportedOperationException

Specifying HostnameVerifier is not supported at the moment

Error message

Specifying HostnameVerifier is not supported at the moment

What it means

The RESTEasy Reactive client does not implement the JAX-RS ClientBuilder.hostnameVerifier() hook and throws UnsupportedOperationException. Hostname verification policy must be configured through Quarkus configuration (e.g. hostname verification algorithm properties) rather than a custom HostnameVerifier.

Source

Thrown at independent-projects/resteasy-reactive/client/runtime/src/main/java/org/jboss/resteasy/reactive/client/impl/ClientBuilderImpl.java:145

        this.keystorePassword = password;
        return this;
    }

    @Override
    public ClientBuilder trustStore(KeyStore trustStore) {
        return trustStore(trustStore, null);
    }

    public ClientBuilder trustStore(KeyStore trustStore, char[] password) {
        this.trustStore = trustStore;
        this.trustStorePassword = password;
        return this;
    }

    @Override
    public ClientBuilder hostnameVerifier(HostnameVerifier verifier) {
        // TODO
        throw new UnsupportedOperationException("Specifying HostnameVerifier is not supported at the moment");
    }

    @Override
    public ClientBuilder executorService(ExecutorService executorService) {
        return this;
    }

    @Override
    public ClientBuilder scheduledExecutorService(ScheduledExecutorService scheduledExecutorService) {
        return this;
    }

    @Override
    public ClientBuilder connectTimeout(long timeout, TimeUnit unit) {
        configuration.property(CONNECT_TIMEOUT, (int) unit.toMillis(timeout));
        return this;
    }

View on GitHub (pinned to e1c734241f)

Solutions

Configure hostname verification via Quarkus config (quarkus.tls.hostname-verification-algorithm or quarkus.rest-client.<name>.verify-host) instead of the builder
For self-signed dev certificates, import the cert into a trust store via keyStore/trustStore configuration rather than disabling hostname verification
Remove the hostnameVerifier call; the reactive client's default verification cannot be overridden per-builder
If a permissive verifier is truly required, use a different client implementation (classic RESTEasy) for that call

Example fix

// before
Client client = ClientBuilder.newBuilder().hostnameVerifier((h, s) -> true).build();

// after (application.properties)
// quarkus.rest-client.my-client.verify-host=true
Client client = ClientBuilder.newBuilder().build();

Defensive patterns

Strategy: fallback

Try / catch

try {
    builder = builder.hostnameVerifier(verifier);
} catch (UnsupportedOperationException e) {
    // fall back to config-based hostname verification
}

Prevention

Do not call hostnameVerifier() on the reactive client builder; use quarkus TLS hostname-verification config
Handle self-signed certs with a trust store, not by disabling hostname verification
Centralize client builder code so unsupported methods are removed in one place
Add an integration test that builds the client so this fails at startup, not in production

When it happens

Trigger: Calling ClientBuilder.newBuilder().hostnameVerifier(verifier) or QuarkusRestClientBuilder.hostnameVerifier(...) when programmatically building a client.

Common situations: Porting clients from classic RESTEasy/Jersey that disable or customize hostname verification (e.g. NoopHostnameVerifier for self-signed certs in dev); security scanners suggesting custom verifiers; test code relaxing hostname checks.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/f37b6795e384956c. Report an issue: GitHub.