quarkusio/quarkus · error · IllegalArgumentException

The TLS configuration to register cannot be null

Error message

The TLS configuration to register cannot be null

What it means

CertificateRecorder.register requires a non-null TlsConfiguration object to store in the registry. A null configuration would leave a registered name with no backing keystore/truststore, so it throws IllegalArgumentException before mutating the registry.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/CertificateRecorder.java:225

    public Optional<TlsConfiguration> getDefault() {
        return get(TlsConfig.DEFAULT_NAME);
    }

    @Override
    public void register(String name, TlsConfiguration configuration) {
        if (name == null) {
            throw new IllegalArgumentException("The name of the TLS configuration to register cannot be null");
        }
        if (name.equals(TlsConfig.DEFAULT_NAME)) {
            throw new IllegalArgumentException("The name of the TLS configuration to register cannot be <default>");
        }
        if (name.equals(TlsConfig.JAVA_NET_SSL_TLS_CONFIGURATION_NAME)) {
            throw new IllegalArgumentException(
                    "The TLS configuration name " + TlsConfig.JAVA_NET_SSL_TLS_CONFIGURATION_NAME
                            + " is reserved for providing access to default SunJSSE keystore; neither Quarkus extensions nor end users can adjust of override it");
        }
        if (configuration == null) {
            throw new IllegalArgumentException("The TLS configuration to register cannot be null");
        }
        certificates.put(name, configuration);
    }

    public Supplier<TlsConfigurationRegistry> getSupplier() {
        return new Supplier<TlsConfigurationRegistry>() {
            @Override
            public TlsConfigurationRegistry get() {
                return CertificateRecorder.this;
            }
        };
    }

    public void register(String name, Supplier<TlsConfiguration> supplier) {
        register(name, supplier.get());
    }

    static <T> InstanceHandle<T> lookupProvider(Class<T> type, String bucketName) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Ensure a valid TlsConfiguration is constructed before calling register; check configuration != null at the call site.
2. If the configuration is genuinely absent, skip the register call instead of registering null.
3. If the null comes from missing config properties, define the keystore/truststore options (quarkus.tls.*.key-store etc.) or provide a TlsCertificateScanner/provider bean.

Example fix

// before
recorder.register(name, configSupplier.get()); // may be null
// after
TlsConfiguration cfg = configSupplier.get();
if (cfg != null) { recorder.register(name, cfg); }

Objects.requireNonNull(config, "TlsConfiguration must be initialized before registration");
if (name == null || name.isBlank()) throw new IllegalArgumentException("name required");

boolean isRegisterable(String name, TlsConfiguration cfg) {
    return name != null && !name.isBlank() && cfg != null;
}

try {
    recorder.register(name, config);
} catch (IllegalArgumentException e) {
    log.errorf("Failed to register TLS config '%s': %s", name, e.getMessage());
}

When it happens

Trigger: Invoking register(name, configuration) where the TlsConfiguration argument is null — e.g. a conditional build step produced no configuration, or a supplier/option returned null.

Common situations: Custom extension recorders passing an optional/defaulted configuration that is absent; reflection or SPI-based construction returning null; code refactoring where a config mapping option was removed and now yields null.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• The TLS configuration name <java-net-ssl> is reserved for pr
• TLS configuration name has already been configured with the
• Client authentication cannot be disabled with this API
• Name cannot start with '/':${name}
• Predicate already set

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/dea22e5660d2d48d. Report an issue: GitHub.