quarkusio/quarkus · error · MongoClientException

Unable to create default SSLContext

Error message

Unable to create default SSLContext

What it means

The getSslContext substitution wraps SSLContext.getDefault(); if no default SSL algorithm is available (NoSuchAlgorithmException, e.g. missing TLS provider in the native image) it wraps the failure in a MongoClientException with this message. It occurs while creating an SSL-enabled MongoDB connection in native mode.

Source

Thrown at extensions/mongodb-client/runtime/src/main/java/io/quarkus/mongodb/runtime/graal/MongoClientSubstitutions.java:105

    @Substitute
    public Stream create(final ServerAddress serverAddress) {
        Stream stream;
        if (sslSettings.isEnabled()) {
            stream = new SocketStream(serverAddress, inetAddressResolver, settings, sslSettings,
                    getSslContext().getSocketFactory(), bufferProvider);
        } else {
            stream = new SocketStream(serverAddress, inetAddressResolver, settings, sslSettings,
                    SocketFactory.getDefault(), bufferProvider);
        }
        return stream;
    }

    @Alias
    private SSLContext getSslContext() {
        try {
            return (sslSettings.getContext() == null) ? SSLContext.getDefault() : sslSettings.getContext();
        } catch (NoSuchAlgorithmException e) {
            throw new MongoClientException("Unable to create default SSLContext", e);
        }
    }
}

@TargetClass(className = "com.mongodb.internal.connection.Compressor")
final class CompressorSubstitute {

}

@TargetClass(InternalStreamConnection.class)
final class InternalStreamConnectionSubstitution {
    @Substitute
    private CompressorSubstitute createCompressor(final MongoCompressor mongoCompressor) {
        throw new UnsupportedOperationException("Unsupported compressor in native mode");
    }
}

@TargetClass(UnixSocketChannelStream.class)

View on GitHub (pinned to e1c734241f)

Solutions

1. Ensure native-image SSL support is enabled (quarkus.ssl.native=true, set automatically by quarkus-tls-registry/ssl extension)
2. Verify the native image includes TLS providers (oracle/graal SSL natives present)
3. Pass an explicit SSLContext via MongoClientSettings instead of relying on the default
4. Run in JVM mode to confirm it is native-image specific

Example fix

// before
quarkus.mongodb.connection-string=mongodb+srv://host/db
// (native build missing SSL natives)
// after
# rebuild ensuring SSL natives are included
quarkus.ssl.native=true

try {
    mongoClient = MongoClients.create(settings);
} catch (MongoClientException e) {
    if (e.getMessage() != null && e.getMessage().contains("SSLContext")) {
        // rebuild native image with SSL natives or supply explicit SSLContext
        throw new IllegalStateException("TLS unavailable in native image; rebuild with SSL support", e);
    }
    throw e;
}

When it happens

Trigger: Creating a MongoClient in native mode with TLS enabled (ssl=true or mongodb+srv:// URI) when sslSettings.getContext() is null and SSLContext.getDefault() fails because the TLS algorithm/provider is not registered in the native image.

Common situations: Native-image build missing the SSL/TSL native libraries or Graal's native SSL support (e.g. built without --enable-all-security-services equivalent or missing quarkus.ssl.native=true); stripped-down container images lacking CA/security providers.

Related errors

• Could not configure MongoDB client with TLS registry
• OCSP is not supported with this SslProvider:
• Trust options have already been set
• Key cert options have already been set
• Could not find Jetty NPN/ALPN or Conscrypt as installed JDK

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/dae8bbfe4e558bc6. Report an issue: GitHub.