How do I enable SSL in QuickFIX/J?

Set SocketUseSSL=Y, then SocketTrustStore (and its password and type) to verify the counterparty, and SocketKeyStore if you need a client certificate.

Does QuickFIX/J verify the server certificate by default?

Not without a trust store. Set SocketTrustStore, and EndpointIdentificationAlgorithm=HTTPS to check the host name.

Why does my QuickFIX/n TLS connection fail only in production?

Often the revocation check: SSLCheckCertificateRevocation is on by default and production servers may not reach the revocation list. Also check SSLServerName against the certificate.

QuickFIX SSL and TLS: Setup per Engine and Handshake Failures

Written and maintained by ZagTrader. Last reviewed 21 October 2026. How this page is sourced and checked

TLS problems show up before the first FIX message, so the FIX logs are often empty and the answer is in the application or engine log. Each engine has its own settings, and two of the defaults below surprise people.

QuickFIX/J

Initiator with a trust store and host name check

SocketUseSSL=Y
SocketTrustStore=counterparty-ca.p12
SocketTrustStorePassword=changeit
TrustStoreType=PKCS12
EndpointIdentificationAlgorithm=HTTPS
EnabledProtocols=TLSv1.2,TLSv1.3
# client certificate, only if the counterparty asks for one
SocketKeyStore=client.p12
SocketKeyStorePassword=changeit
KeyStoreType=PKCS12

Without SocketTrustStore, QuickFIX/J accepts any server certificate: its code falls back to a trust manager that does not check. Always set a trust store for production.
KeyStoreType and TrustStoreType default to JKS. A .p12 file needs PKCS12, or loading fails with a password or format error.
Host names are not checked unless EndpointIdentificationAlgorithm is set, usually to HTTPS. With it set, connecting by IP address fails unless the certificate lists that address.
If the key store file is not found, QuickFIX/J logs "keystore not found, using empty keystore" and continues without a certificate. An acceptor then has nothing to present and the handshake fails.
NeedClientAuth=Y on an acceptor requires client certificates. UseSNI and SNIHostName (3.x) set the server name sent to the acceptor.

QuickFIX/n

Initiator

SSLEnable=Y
SSLServerName=fix.example.com
SSLProtocols=Tls12
SSLCertificate=client.pfx
SSLCertificatePassword=changeit
SSLValidateCertificates=Y
SSLCheckCertificateRevocation=Y

SSLServerName defaults to SocketConnectHost. Connecting by IP address with a certificate issued to a host name fails the name check; set SSLServerName to the name on the certificate.
SSLCheckCertificateRevocation is on by default. On a server that cannot reach the certificate authority's revocation list, the check fails and so does the handshake. Open the route, or set it to N if your security policy allows.
An acceptor requires client certificates by default (SSLRequireClientCertificate=Y), and checks them against SSLCACertificate.
QuickFIX/n logs failures as "Unable to perform authentication against server", followed by the .NET reason.

QuickFIX C++

Build QuickFIX with SSL support and use the SSL classes (SSLSocketInitiator, ThreadedSSLSocketInitiator, and the acceptor equivalents) instead of the plain socket classes.
The SSL settings go in [DEFAULT]: SSLProtocol, SSLCipherSuite, CertificationAuthoritiesFile, ClientCertificateFile and ClientCertificateKeyFile on an initiator, ServerCertificateFile, ServerCertificateKeyFile and CertificateVerifyLevel on an acceptor.
Certificates and keys are PEM files.

Common handshake errors

Message (Java, .NET or OpenSSL wording)	Usual cause
PKIX path building failed / certificate verify failed / RemoteCertificateChainErrors	The trust store does not hold the counterparty's CA, or the counterparty does not send its intermediate certificates.
No subject alternative names matching / RemoteCertificateNameMismatch	The name or IP address you connect to is not on the certificate. Set the server name setting to the certificate's name.
handshake_failure, no cipher suites in common	No shared TLS version or cipher, or the acceptor has no certificate loaded.
certificate_required, bad_certificate	The acceptor wants a client certificate you did not send, or does not trust it.
Unrecognized SSL message, plaintext connection / wrong version number	One side speaks TLS and the other plain TCP.
RevocationStatusUnknown	The revocation list could not be fetched (QuickFIX/n checks it by default).

Questions

How do I enable SSL in QuickFIX/J?: Set SocketUseSSL=Y, then SocketTrustStore (and its password and type) to verify the counterparty, and SocketKeyStore if you need a client certificate.
Does QuickFIX/J verify the server certificate by default?: Not without a trust store. Set SocketTrustStore, and EndpointIdentificationAlgorithm=HTTPS to check the host name.
Why does my QuickFIX/n TLS connection fail only in production?: Often the revocation check: SSLCheckCertificateRevocation is on by default and production servers may not reach the revocation list. Also check SSLServerName against the certificate.

The FIX side of the problem

What the error means on any FIX engine, with example messages you can open in the parser:

Logon rejected

Reference

554 Password

Logon 35=A

Sources

Setting names, defaults and message texts were checked against the projects' source code and documentation on the review date shown at the top of the page. Behaviour can change between releases; check the version you run. This guide is independent and not affiliated with the QuickFIX projects.