apache/druid · error · IllegalStateException

Failed to configure TLS for OpenLineage HTTP transport

Error message

Failed to configure TLS for OpenLineage HTTP transport

What it means

OpenLineageRequestLoggerProvider.buildHttpClient sets up an SSLContext from the configured truststore/keystore for the HTTP transport. Any exception during TLS setup (bad keystore path, wrong password, unsupported algorithm) is wrapped in IllegalStateException with this message.

Source

Thrown at extensions-contrib/openlineage-emitter/src/main/java/org/apache/druid/extensions/openlineage/OpenLineageRequestLoggerProvider.java:168

          KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
          // Resolve once to avoid inconsistent values if the provider is dynamic.
          String rawKeyPw = keyStorePassword != null ? keyStorePassword.getPassword() : null;
          char[] keyPwChars = rawKeyPw != null ? rawKeyPw.toCharArray() : null;
          keyStore.load(in, keyPwChars);
          kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
          kmf.init(keyStore, keyPwChars);
        }
      }
      SSLContext sslContext = SSLContext.getInstance("TLS");
      sslContext.init(
          kmf != null ? kmf.getKeyManagers() : null,
          tmf != null ? tmf.getTrustManagers() : null,
          null
      );
      return builder.setSSLContext(sslContext).build();
    }
    catch (Exception e) {
      throw new IllegalStateException("Failed to configure TLS for OpenLineage HTTP transport", e);
    }
  }
}

View on GitHub (pinned to 9b90983fd2)

Solutions

Verify the truststore/keystore file path exists and is readable by the Druid process
Confirm store passwords and types (JKS/PKCS12) match the actual file format
Test loading the store with `keytool -list -keystore <path>` using the configured password
If no custom TLS is needed, remove the TLS properties so the default client is used

Example fix

// before
ssl.trustStorePath=/etc/druid/truststore.jks  (file missing)
// after
ssl.trustStorePath=/etc/druid/certs/truststore.p12
ssl.trustStoreType=PKCS12
ssl.trustStorePassword=<correct-password>

Defensive patterns

Strategy: try-catch

Validate before calling

File ks = new File(trustStorePath);
if (ks.exists() && ks.canRead() && password != null) {
  KeyStore.getInstance(new FileInputStream(ks), password.toCharArray()); // fail fast outside service startup
}

Try / catch

try { provider.httpClient(); } catch (IllegalStateException e) { if (e.getCause() != null) { inspectTlsCause(e.getCause()); } }

Prevention

Verify keystore/truststore paths, passwords, and types with keytool before deployment
Ensure the Druid process user can read TLS files
Keep store type (JKS vs PKCS12) consistent with the file format

When it happens

Trigger: Configuring druid.request.logging TLS properties (truststore path/password/type) that cannot be loaded: file missing, invalid password, malformed PKCS12/JKS store, or unavailable TLS algorithm; triggered lazily when the provider builds the shared HTTP client.

Common situations: Pointing at a non-existent or unreadable truststore file, copy-pasting a password with trailing whitespace, using a store type unsupported by the JVM, or a PEM file supplied where a keystore is expected.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/3a06efb8118df1a3. Report an issue: GitHub.