apache/druid · error · InternalServerError

Encryption failed. Check service logs.

Error message

Encryption failed. Check service logs.

What it means

CryptoService.encrypt wraps all exceptions from the cipher operation (ecipher.doFinal etc.) and rethrows an InternalServerError with a generic message; the underlying exception is only logged server-side. This hides key/cipher problems behind a blanket 500-style error.

Solutions

1. Check service logs for the wrapped exception (logged at warn with details) to find the real cipher error
2. Verify crypto config: password/salt, keyFactory algorithm, cipher transformation and key size are valid and consistent with the JDK/provider
3. Test key derivation separately (getKeyFromPassword) to confirm the algorithm is available in the JVM
4. Ensure the same JCE provider/policies are installed on all nodes

Example fix

// before
new CryptoService("bad-alg", ...) // throws at encrypt
// after
new CryptoService("PBKDF2WithHmacSHA256", "AES/CBC/PKCS5Padding", ...)

// verify cipher availability before encrypting
Cipher.getInstance(transformation); SecretKeyFactory.getInstance(keyFactoryAlg);

try { byte[] ct = cryptoService.encrypt(plain); } catch (InternalServerError ise) { logger.error("encrypt failed; check CryptoService logs", ise); throw new RetryableCryptoException(ise); }

When it happens

Trigger: Calling CryptoService.encrypt when the cipher is misconfigured (bad algorithm/mode/padding), the SecretKey is invalid or uninitialized, or doFinal fails (bad key size, JCE provider restrictions, corrupted input state).

Common situations: Wrong password/secretKeyFactoryAlg config, missing JCE unlimited strength policy on old JDKs, algorithm name typos like 'PBKDF2WithHmacSHA256' misspellings, FIPS providers rejecting the configured transformation.

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

• Decryption failed. Check service logs.
• S3StorageConfig cannot be null!
• Unable to stop Jetty server.

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/d508dcf4a9a2c68d. Report an issue: GitHub.

Appendix: source

Thrown at processing/src/main/java/org/apache/druid/crypto/CryptoService.java:129

      SecretKey tmp = getKeyFromPassword(passPhrase, salt);
      SecretKey secret = new SecretKeySpec(tmp.getEncoded(), cipherAlgName);

      // error-prone warns if the transformation is not a compile-time constant
      // since it cannot check it for insecure combinations.
      @SuppressWarnings("InsecureCryptoUsage")
      Cipher ecipher = Cipher.getInstance(transformation);
      ecipher.init(Cipher.ENCRYPT_MODE, secret);
      return new EncryptedData(
          salt,
          ecipher.getParameters().getParameterSpec(IvParameterSpec.class).getIV(),
          ecipher.doFinal(plain)
      ).toByteAray();
    }
    catch (Exception ex) {
      log.noStackTrace().warn(ex, "Encryption failed");
      throw InternalServerError.exception("Encryption failed. Check service logs.");
    }
  }

  public byte[] decrypt(byte[] data)
  {
    try {
      EncryptedData encryptedData = EncryptedData.fromByteArray(data);

      SecretKey tmp = getKeyFromPassword(passPhrase, encryptedData.getSalt());
      SecretKey secret = new SecretKeySpec(tmp.getEncoded(), cipherAlgName);

      // error-prone warns if the transformation is not a compile-time constant
      // since it cannot check it for insecure combinations.
      @SuppressWarnings("InsecureCryptoUsage")
      Cipher dcipher = Cipher.getInstance(transformation);
      dcipher.init(Cipher.DECRYPT_MODE, secret, new IvParameterSpec(encryptedData.getIv()));
      return dcipher.doFinal(encryptedData.getCipher());
    }
    catch (Exception ex) {

View on GitHub (pinned to 9b90983fd2)