quarkusio/quarkus · critical · ConfigurationException

TLS configuration '' was specified, but no TLS configuration

Error message

TLS configuration '' was specified, but no TLS configuration registry could be found.

What it means

When a TLS configuration name is specified for a GraphQL client but the TLS registry bean itself is absent, the recorder cannot resolve any TLS configuration and throws this ConfigurationException. The TLS registry only exists when the TLS registry support is on the classpath and initialized; without it, a named configuration can never be resolved, so startup fails deliberately.

Source

Thrown at extensions/smallrye-graphql-client/runtime/src/main/java/io/quarkus/smallrye/graphql/client/runtime/SmallRyeGraphQLClientRecorder.java:260

        if (Arc.container() != null) {
            TlsConfigurationRegistry tlsConfigurationRegistry = Arc.container().select(TlsConfigurationRegistry.class).orNull();
            if (tlsConfigurationRegistry != null) {
                if (quarkusConfig.tlsConfigurationName().isPresent()) {
                    // explicit TLS config
                    Optional<TlsConfiguration> namedConfig = TlsConfiguration.from(tlsConfigurationRegistry,
                            quarkusConfig.tlsConfigurationName());
                    if (namedConfig.isEmpty()) {
                        throw new ConfigurationException("TLS configuration '" + quarkusConfig.tlsConfigurationName().get()
                                + "' was specified, but it does not exist.");
                    }
                    return namedConfig;
                } else {
                    // no explicit TLS config
                    return tlsConfigurationRegistry.getDefault();
                }
            } else {
                if (quarkusConfig.tlsConfigurationName().isPresent()) {
                    throw new ConfigurationException("TLS configuration '" + quarkusConfig.tlsConfigurationName().get()
                            + "' was specified, but no TLS configuration registry could be found.");
                }
            }
        }
        return Optional.empty();
    }

    private Optional<ProxyConfiguration> resolveProxyConfiguration(GraphQLClientConfig clientConfig) {
        if (Arc.container() != null) {
            ProxyConfigurationRegistry proxyConfigurationRegistry = Arc.container().select(ProxyConfigurationRegistry.class)
                    .orNull();
            if (proxyConfigurationRegistry != null) {
                if (clientConfig.proxyConfigurationName().isPresent()) {
                    // explicit proxy config
                    Optional<ProxyConfiguration> namedConfig = proxyConfigurationRegistry
                            .get(clientConfig.proxyConfigurationName());
                    if (namedConfig.isEmpty()) {
                        throw new ConfigurationException("Proxy configuration '" + clientConfig.proxyConfigurationName().get()

View on GitHub (pinned to e1c734241f)

Solutions

Ensure the quarkus-smallrye-graphql-client extension (which brings TLS registry support) is a project dependency
Upgrade Quarkus so the centralized TLS registry (quarkus.tls.*) is available
Remove quarkus.smallrye-graphql-client.<client>.tls-configuration-name and configure TLS another way (e.g. per-client keystore/truststore properties if available)

Example fix

// before (pom.xml) — raw library without TLS registry
<dependency>
  <groupId>io.smallrye</groupId>
  <artifactId>smallrye-graphql-client</artifactId>
</dependency>

// after
<dependency>
  <groupId>io.quarkus</groupId>
  <artifactId>quarkus-smallrye-graphql-client</artifactId>
</dependency>

Defensive patterns

Strategy: validation

Validate before calling

// Verify the extension providing the TLS registry is on the classpath
Class.forName("io.quarkus.tls.TlsConfigurationRegistry", false,
        Thread.currentThread().getContextClassLoader());

Try / catch

try {
    buildClientConfig();
} catch (ConfigurationException e) {
    if (e.getMessage().contains("no TLS configuration registry")) {
        throw new IllegalStateException("Add quarkus-smallrye-graphql-client / TLS registry support, or drop tls-configuration-name", e);
    }
    throw e;
}

Prevention

Always consume SmallRye GraphQL clients through the Quarkus extension, not raw SmallRye artifacts
Do not set tls-configuration-name in libraries usable outside Quarkus TLS-registry contexts
Pin to a Quarkus version that includes the unified TLS registry
Run a smoke startup test in CI that exercises client configuration

When it happens

Trigger: quarkus.smallrye-graphql-client.<client>.tls-configuration-name is set, but tlsConfigurationRegistry is null — i.e. the TLS registry support (quarkus.tls.* machinery) is not available in this application build.

Common situations: Depending only on raw SmallRye GraphQL client libraries instead of the quarkus-smallrye-graphql-client extension; an old Quarkus version predating the TLS registry; a custom/trimmed build excluding TLS registry support while config still references a named TLS configuration.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/e081ab508c37592f. Report an issue: GitHub.