quarkusio/quarkus · error · io.quarkus.runtime.configuration.ConfigurationException

Unable to find the TLS configuration '' for the reactive dat

Error message

Unable to find the TLS configuration '' for the reactive datasource.

What it means

configureSsl() looks up the named TLS configuration in TlsConfigurationRegistry. When quarkus.datasource."x".reactive.tls-configuration-name refers to a name that no Tls @ConfigMapping (quarkus.tls.<name>.*) defines, it throws ConfigurationException naming the missing configuration.

Source

Thrown at extensions/reactive-datasource/runtime/src/main/java/io/quarkus/reactive/datasource/runtime/ReactivePoolUtil.java:177

    /**
     * Apply SSL/TLS, reconnect, and hostname verification settings from the generic reactive
     * datasource config to connect options.
     * <p>
     * When a named TLS configuration is set via {@code tls-configuration-name}, it takes precedence
     * over manual SSL properties (trust-certificate-*, key-certificate-*, trust-all, hostname-verification-algorithm).
     */
    public static void configureSsl(SqlConnectOptions connectOptions,
            DataSourceReactiveRuntimeConfig config,
            TlsConfigurationRegistry tlsRegistry) {
        if (config.tlsConfigurationName().isPresent()) {
            String tlsConfigName = config.tlsConfigurationName().get();
            if (tlsRegistry == null) {
                throw new ConfigurationException(
                        "TLS configuration name '" + tlsConfigName + "' is set but the TLS registry is not available.");
            }
            Optional<TlsConfiguration> maybeTlsConfig = tlsRegistry.get(tlsConfigName);
            if (maybeTlsConfig.isEmpty()) {
                throw new ConfigurationException("Unable to find the TLS configuration '" + tlsConfigName
                        + "' for the reactive datasource.");
            }
            TlsConfiguration tlsConfig = maybeTlsConfig.get();
            ClientSSLOptions sslOptions = tlsConfig.getClientSSLOptions();
            if (sslOptions == null) {
                sslOptions = new ClientSSLOptions();
            }
            connectOptions.setSslOptions(sslOptions);

            if (hasManualSslProperties(config)) {
                log.warn("Manual SSL properties (trust-certificate-*, key-certificate-*, trust-all,"
                        + " hostname-verification-algorithm) are ignored when a named TLS configuration"
                        + " (tls-configuration-name=" + tlsConfigName + ") is set.");
            }
        } else {
            configureManualSsl(connectOptions, config);
        }

View on GitHub (pinned to e1c734241f)

Solutions

Define the named TLS configuration, e.g. quarkus.tls.key-store.p12.path=... under the same name referenced by the datasource
Fix typos in quarkus.datasource."<name>".reactive.tls-configuration-name
Verify the quarkus.tls."<name>" block is present in the active profile (not only %prod/%dev)
Use the default registry name if you only need one config: reference the default TLS config instead of a custom name

Example fix

// before
quarkus.datasource.db.reactive.tls-configuration-name=dbtls
// (no matching block)
// after
quarkus.datasource.db.reactive.tls-configuration-name=dbtls
quarkus.tls.dbtls.key-store.p12.path=certs/db.p12
quarkus.tls.dbtls.key-store.p12.password=secret

Defensive patterns

Strategy: validation

Validate before calling

String name = config.tlsConfigurationName().orElse(null);
if (name != null && !configRootNames.contains("quarkus.tls.\"" + name + "\"")) {
    throw new IllegalStateException("No quarkus.tls." + name + " configuration defined");
}

Try / catch

try {
    ReactivePoolUtil.configureSsl(opts, config, registry);
} catch (ConfigurationException e) {
    log.errorf("Define quarkus.tls.%s.* properties for the datasource", referencedName);
    throw e;
}

Prevention

Keep the tls-configuration-name value and quarkus.tls."name" block in sync
Grep application.properties for tls-configuration-name and verify each has a matching block
Confirm blocks are in the active profile

When it happens

Trigger: quarkus.datasource."<name>".reactive.tls-configuration-name=<value> set, registry available, but no quarkus.tls.<value>.* properties exist; or the TLS config is defined in a profile/environment not active at startup.

Common situations: Typo in the TLS configuration name; renaming the quarkus.tls."name" block without updating datasource references; config imported only in a non-active profile (e.g. only in %prod).

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/8e33f4bd1f27b9bc. Report an issue: GitHub.