apache/druid · error · IllegalStateException

Can't load TrustStore. Truststore path or password is not se

Error message

Can't load TrustStore. Truststore path or password is not set.

What it means

This error is thrown when an InfluxDB emitter is configured to use the https protocol but the trust store path or trust store password is not set in the emitter configuration. A TLS connection to InfluxDB requires a trust store containing the server certificate's CA, and without a path or password the SSL context cannot be built, so the emitter fails fast with an IllegalStateException instead of attempting an insecure or broken connection.

Source

Thrown at extensions-contrib/influxdb-emitter/src/main/java/org/apache/druid/emitter/influxdb/InfluxdbEmitter.java:229

  public void transformAndSendToInfluxdb(LinkedBlockingQueue<ServiceMetricEvent> eventsQueue)
  {
    StringBuilder payload = new StringBuilder();
    int initialQueueSize = eventsQueue.size();
    for (int i = 0; i < initialQueueSize; i++) {
      payload.append(transformForInfluxSystems(eventsQueue.poll()));
    }
    postToInflux(payload.toString());
  }

  private HttpClient buildInfluxdbClient()
  {
    if ("https".equals(influxdbEmitterConfig.getProtocol())) {
      SSLContext sslContext;
      if (influxdbEmitterConfig.getTrustStorePath() == null || influxdbEmitterConfig.getTrustStorePassword() == null) {
        String msg = "Can't load TrustStore. Truststore path or password is not set.";
        log.error(msg);
        throw new IllegalStateException(msg);
      }

      try (FileInputStream in = new FileInputStream(new File(influxdbEmitterConfig.getTrustStorePath()))) {
        KeyStore store = KeyStore.getInstance(influxdbEmitterConfig.getTrustStoreType());
        store.load(in, influxdbEmitterConfig.getTrustStorePassword().toCharArray());
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(store);
        sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, tmf.getTrustManagers(), null);
      }
      catch (Exception ex) {
        String msg = "Unable to load TrustStore";
        log.error(msg);
        throw new IllegalStateException(msg);
      }
      return HttpClients.custom().setSSLContext(sslContext).setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE).build();
    } else {
      return HttpClientBuilder.create().build();

View on GitHub (pinned to 9b90983fd2)

Solutions

Set both druid.emitter.influxdb.trustStorePath and druid.emitter.influxdb.trustStorePassword in the emitter config.
Verify the protocol value: if TLS client-auth to a well-known CA is not required, use protocol "http" instead.
Confirm the config properties file actually contains the keys (check for typos and that the file is the one being loaded).
If the password is provisioned via env var or secret store, verify it is non-null at runtime in the target environment.

Example fix

// before
druid.emitter.influxdb.protocol=https
// after
druid.emitter.influxdb.protocol=https
druid.emitter.influxdb.trustStorePath=/path/to/truststore.jks
druid.emitter.influxdb.trustStorePassword=changeit

Defensive patterns

Strategy: validation

Validate before calling

// before enabling https emitter
if ("https".equals(cfg.getProtocol())) {
  if (cfg.getTrustStorePath() == null || cfg.getTrustStorePassword() == null) {
    throw new IllegalArgumentException("trustStorePath and trustStorePassword are required for https protocol");
  }
  if (!new File(cfg.getTrustStorePath()).canRead()) {
    throw new IllegalArgumentException("trust store not readable: " + cfg.getTrustStorePath());
  }
}

Prevention

Always set both trustStorePath and trustStorePassword whenever protocol is https.
Validate emitter configs at startup with a config-check step before the emitter is used.
Keep trust store paths identical on all Druid nodes (configuration management).
Provision passwords via secret management so they are never null.

When it happens

Trigger: Calling buildInfluxdbClient when influxdbEmitterConfig.getProtocol() equals "https" while either getTrustStorePath() or getTrustStorePassword() returns null, e.g. the druid.emitter.influxdb.trustStorePath or trustStorePassword runtime property was omitted from the configuration.

Common situations: Operators switch the emitter protocol from http to https but forget to add the trustStore properties; configuration is loaded from a properties file where the password key is missing or misspelled; secrets are injected via environment variables that are unset in the target environment.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/3257dafbfed15d0d. Report an issue: GitHub.