apache/druid · error · IllegalArgumentException

Could not find certificate checker with type

Error message

Could not find certificate checker with type: <checkerType>

What it means

TLSCertificateCheckerModule's CheckedProvider cannot resolve a TLSCertificateChecker bound to the requested checkerType among the Guice bindings; it throws IAE "Could not find certificate checker with type: <checkerType>". Druid supports pluggable TLS certificate checkers identified by a string type in client TLS config.

Solutions

1. Correct the checker type string in the TLS config to a built-in or extension-provided type.
2. Load the extension that provides the TLSCertificateChecker (add to druid.extensions.loadList).
3. Verify the extension registers its checker binding in TLSCertificateCheckerModule.
4. Restart the service after the change.

Example fix

// before
// druid.client.https.certificateChecker = CertCheckerHighAssurance // not bound
// after
// druid.client.https.certificateChecker = hostnameVerification

// Verify the checker type is bound before starting services that use TLS
final List<Binding<TLSCertificateChecker>> bindings = injector.findBindingsByType(new TypeLiteral<TLSCertificateChecker>() {});
boolean ok = bindings.stream().anyMatch(b -> checkerType.equals(b.getProvider().getKey().getAnnotationValue()));

try { injector.getInstance(TLSCertificateChecker.class); }
catch (IAE e) { if (e.getMessage().startsWith("Could not find certificate checker")) { failStartupWithConfigHint(e); } else { throw e; } }

When it happens

Trigger: Setting druid.client.https.certificateChecker (or equivalent TLS config) to a type string with no matching TLSCertificateChecker Guice binding (no extension providing it and not a built-in type).

Common situations: Typo in the checker type; using a checker provided by an extension that is not loaded; copying config from a cluster with an extra TLS extension installed.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• A valid tlsPort needs to specified when druid.enableTlsPort…
• At least one of baseDir or files should be specified
• bucketSize must be a power of two (from 1 up to 128) but…
• Can't load TrustStore. Truststore path or password is not…
• Cannot delete all segment files since Azure Deep Storage…

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/93fad8ad549102df. Report an issue: GitHub.

Appendix: source

Thrown at server/src/main/java/org/apache/druid/server/security/TLSCertificateCheckerModule.java:83

    private TLSCertificateChecker checker = null;

    public TLSCertificateCheckerProvider(
        String checkerType
    )
    {
      this.checkerType = checkerType;
    }

    @Inject
    public void inject(Injector injector)
    {
      final List<Binding<TLSCertificateChecker>> checkerBindings = injector.findBindingsByType(new TypeLiteral<>()
      {
      });

      checker = findChecker(checkerType, checkerBindings);
      if (checker == null) {
        throw new IAE("Could not find certificate checker with type: " + checkerType);
      }
    }

    @Override
    public TLSCertificateChecker get()
    {
      if (checker == null) {
        throw new ISE("Checker was null, that's bad!");
      }
      return checker;
    }

    private TLSCertificateChecker findChecker(
        String checkerType,
        List<Binding<TLSCertificateChecker>> checkerBindings
    )
    {
      for (Binding<TLSCertificateChecker> binding : checkerBindings) {

View on GitHub (pinned to 9b90983fd2)