apache/druid · error · IllegalStateException

Failed to build SSLContext

Error message

Failed to build SSLContext

What it means

Wrapper failure in buildSslContext: the TLSUtils.ClientSSLContextBuilder threw while loading the configured truststore/keystore (missing file, wrong password, unsupported type/algorithm); the original exception is rethrown with this message.

Solutions

1. Check the cause: typically a missing or unreadable trustStorePath/keyStorePath, or a wrong store password.
2. Validate trustStoreType, protocol and algorithm values against the JVM's supported set.

When it happens

Trigger: Thrown at extensions-contrib/consul-extensions/src/main/java/org/apache/druid/consul/discovery/ConsulClients.java:137 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/455d11ccb2bc1627. Report an issue: GitHub.

Appendix: source

Thrown at extensions-contrib/consul-extensions/src/main/java/org/apache/druid/consul/discovery/ConsulClients.java:137

    try {
      return new TLSUtils.ClientSSLContextBuilder()
          .setProtocol(config.getProtocol())
          .setTrustStoreType(config.getTrustStoreType())
          .setTrustStorePath(config.getTrustStorePath())
          .setTrustStoreAlgorithm(config.getTrustStoreAlgorithm())
          .setTrustStorePasswordProvider(config.getTrustStorePasswordProvider())
          .setKeyStoreType(config.getKeyStoreType())
          .setKeyStorePath(config.getKeyStorePath())
          .setKeyStoreAlgorithm(config.getKeyManagerFactoryAlgorithm())
          .setCertAlias(config.getCertAlias())
          .setKeyStorePasswordProvider(config.getKeyStorePasswordProvider())
          .setKeyManagerFactoryPasswordProvider(config.getKeyManagerPasswordProvider())
          .setValidateHostnames(config.getValidateHostnames())
          .build();
    }
    catch (Exception e) {
      LOGGER.error(e, "Failed to build SSLContext from ConsulSSLConfig");
      throw new IllegalStateException("Failed to build SSLContext", e);
    }
  }

  /**
   * Create an HttpClient with the given SSLContext.
   */
  private static HttpClient createHttpClientWithOptionalBasicAuth(
      SSLContext sslContext,
      String basicUser,
      String basicPass,
      ConsulDiscoveryConfig.ConnectionConfig connection,
      ConsulSSLConfig sslConfig
  )
  {
    HttpClientBuilder httpBuilder = HttpClients.custom();

    // Always use a PoolingHttpClientConnectionManager with proper pool sizing
    // This prevents ConnectionPoolTimeoutException when multiple threads use the client concurrently

View on GitHub (pinned to 9b90983fd2)