quarkusio/quarkus · error · SSLException

This verification path not implemented

Error message

This verification path not implemented

What it means

The Keycloak HttpClientBuilder wraps a hostname verifier and deliberately throws this SSLException for the verify(String host, X509Certificate cert) overload, because the adapter only implements session-based hostname verification. It indicates the HTTP client attempted a certificate-only verification path that this adapter does not support.

Source

Thrown at extensions/keycloak-authorization/runtime/src/main/java/io/quarkus/keycloak/pep/runtime/HttpClientBuilder.java:243

        return this;
    }

    static class VerifierWrapper implements X509HostnameVerifier {
        protected HostnameVerifier verifier;

        VerifierWrapper(HostnameVerifier verifier) {
            this.verifier = verifier;
        }

        @Override
        public void verify(String host, SSLSocket ssl) throws IOException {
            if (!verifier.verify(host, ssl.getSession()))
                throw new SSLException("Hostname verification failure");
        }

        @Override
        public void verify(String host, X509Certificate cert) throws SSLException {
            throw new SSLException("This verification path not implemented");
        }

        @Override
        public void verify(String host, String[] cns, String[] subjectAlts) throws SSLException {
            throw new SSLException("This verification path not implemented");
        }

        @Override
        public boolean verify(String s, SSLSession sslSession) {
            return verifier.verify(s, sslSession);
        }
    }

    public HttpClientBuilder spNegoSchemeFactory(SPNegoSchemeFactory spnegoSchemeFactory) {
        this.spNegoSchemeFactory = spnegoSchemeFactory;
        return this;
    }

View on GitHub (pinned to e1c734241f)

Solutions

1. Avoid the unsupported path: use the standard HttpClientBuilder produced by the adapter (default configuration) so the SSLSession-based verify is used.
2. Update the quarkus-keycloak-authorization extension — newer versions may implement or remove this path.
3. If you control the connection factory, ensure hostname verification goes through verify(String, SSLSocket) / verify(String, SSLSession).

Example fix

// before: custom socket factory routing to cert-only verify
new SSLConnectionSocketFactory(customContext, new X509HostnameVerifier() { ... })
// after: let the adapter build the client
CloseableHttpClient client = HttpClientBuilder.create(adapterConfig).build();

// ensure you use the adapter's standard builder, not a custom X509HostnameVerifier path
if (socketFactory instanceof SSLConnectionSocketFactory f && usesLegacyVerifier(f)) {
    throw new IllegalStateException("Remove legacy X509HostnameVerifier wiring");
}

try {
    return HttpClientBuilder.create(adapterConfig).build();
} catch (SSLException e) {
    if ("This verification path not implemented".equals(e.getMessage())) {
        log.warn("Fell into unsupported cert-only hostname verify path; check custom TLS wiring");
    }
    throw e;
}

When it happens

Trigger: The Apache HttpClient (or a transport layer) invokes the X509Certificate-based verify overload during a TLS handshake instead of the SSLSession-based path — typically when a custom connection setup or alternate HttpClient implementation routes verification through that overload.

Common situations: Using the Keycloak PEP client in an environment where the HTTP client's TLS layer selects the certificate-only verification callback; unusual proxy or custom SSLConnectionSocketFactory setups interacting with the adapter's builder.

Related errors

• Failed to create Keycloak Admin client SSLContext
• Hostname verification failure
• Specifying SSLContext is not supported at the moment
• Specifying HostnameVerifier is not supported at the moment
• Not Allowed

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/9f42cca6f7446fb5. Report an issue: GitHub.