quarkusio/quarkus · error · IllegalArgumentException

Trust options have already been set

Error message

Trust options have already been set

What it means

SSLConfigHelper.configureXxxTrustOptions methods copy PEM/JKS/PFX trust material into Vert.x TCPSSLOptions. To prevent silently overwriting trust configuration, each first calls ensureTrustOptionsNotSet, which throws IllegalArgumentException if trustOptions were already configured on the same options object.

Source

Thrown at extensions/grpc/runtime/src/main/java/io/quarkus/grpc/runtime/supports/SSLConfigHelper.java:72

            ensureTrustOptionsNotSet(options);
            options.setTrustOptions(toPfxOptions(configuration));
        }
    }

    private static PfxOptions toPfxOptions(GrpcClientConfiguration.TlsClientConfig.PfxConfiguration configuration) {
        PfxOptions pfxOptions = new PfxOptions();
        if (configuration.path().isPresent()) {
            pfxOptions.setPath(configuration.path().get());
        }
        if (configuration.password().isPresent()) {
            pfxOptions.setPassword(configuration.password().get());
        }
        return pfxOptions;
    }

    private static void ensureTrustOptionsNotSet(TCPSSLOptions options) {
        if (options.getTrustOptions() != null) {
            throw new IllegalArgumentException("Trust options have already been set");
        }
    }

    public static void configurePemKeyCertOptions(TCPSSLOptions options,
            GrpcClientConfiguration.TlsClientConfig.PemKeyCertConfiguration configuration) {
        if (configuration.certs().isPresent() && !configuration.certs().get().isEmpty() && configuration.keys().isPresent()
                && !configuration.keys().get().isEmpty()) {
            ensureKeyCertOptionsNotSet(options);
            options.setKeyCertOptions(toPemKeyCertOptions(configuration));
        }
    }

    private static KeyCertOptions toPemKeyCertOptions(
            GrpcClientConfiguration.TlsClientConfig.PemKeyCertConfiguration configuration) {
        PemKeyCertOptions pemKeyCertOptions = new PemKeyCertOptions();
        if (configuration.certs().isPresent()) {
            for (String cert : configuration.certs().get()) {
                pemKeyCertOptions.addCertPath(cert);

View on GitHub (pinned to e1c734241f)

Solutions

1. Remove all but one trust-options configuration source for the client/server
2. Decide on a single trust store format (PEM, JKS, or PFX) and keep only that
3. If combining is intended, merge material into one store instead of setting options twice

Example fix

// before
quarkus.grpc.clients.hello.tls.trust-certificate-pem-files=ca.pem
quarkus.grpc.clients.hello.tls.trust-certificate-jks=truststore.jks
// after
quarkus.grpc.clients.hello.tls.trust-certificate-pem-files=ca.pem

if (options.getTrustOptions() != null) {
    throw new IllegalArgumentException("Choose one trust source: PEM, JKS or PFX");
}

try {
    SSLConfigHelper.configureJksTrustOptions(options, cfg);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("Trust options")) {
        LOG.error("Multiple trust sources configured for the same client/server");
    }
    throw e;
}

When it happens

Trigger: Configuring more than one trust source (e.g. both quarkus.grpc.clients.<name>.tls.trust-certificate-pem-files and trust-certificate-jks) on the same client/server TLS config; calling configurePemTrustOptions then configureJksTrustOptions on the same TCPSSLOptions instance.

Common situations: Mixing PEM and JKS trust store settings in application.properties; programmatically setting trust options then applying config-based ones; merging TLS configs from two sources.

Related errors

• Key cert options have already been set
• Unable to find the TLS configuration ${tlsConfigurationName}
• Unable to find the GrpcClientConfigProvider
• Unable to retrieve the gRPC Channel ${name}
• Failed to create Keycloak Admin client SSLContext

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/86a9daa43647e870. Report an issue: GitHub.