What causes "No sslContext set, cannot do https" in apache/druid?

Configure the client with an SSLContext: supply TLS settings (trustStore/keyStore path & password, or a custom SSLContext) so HttpClientInit builds an SSL-enabled client.

apache/druid · error · IllegalStateException

No sslContext set, cannot do https

Error message

No sslContext set, cannot do https

What it means

ChannelResourceFactory creates Netty channels for pooled HTTP connections. For https URLs it needs an SSLContext to build an SSLEngine; if the client was constructed without one, generate() throws IllegalStateException — https is simply not configured on this client instance.

Solutions

Configure the client with an SSLContext: supply TLS settings (trustStore/keyStore path & password, or a custom SSLContext) so HttpClientInit builds an SSL-enabled client.
If TLS is not intended, change the target URL scheme from https:// to http://.
For custom code, call the client factory overload that accepts a non-null SSLContext.
Verify the TLS config properties are actually read (correct config file/section, no typos) so the client is created with sslContext != null.

Example fix

// before
HttpClient client = HttpClientInit.createClient(new HttpClientConfig(HttpClientConfig.builder().build()), lifecycle);
// https:// request -> IllegalStateException: No sslContext set
// after
SSLContext sslContext = SimpleSSLSocketFactory.getSSLContextFromKeystores(trustPath, trustPassword, keyPath, keyPassword);
HttpClient client = HttpClientInit.createClient(
  new HttpClientConfig(HttpClientConfig.builder().setSslContext(sslContext).build()), lifecycle);

Defensive patterns

Strategy: validation

Validate before calling

if ("https".equals(url.getProtocol()) && sslContext == null) {
  throw new IllegalStateException("Configure TLS (trust/key stores) before using https URLs");
}

Try / catch

try {
  return client.go(request, handler, returnValueAccumulator);
} catch (IllegalStateException e) {
  if (e.getMessage().contains("No sslContext set")) {
    throw new RuntimeException("https requested but client has no SSLContext; configure TLS settings", e);
  }
  throw e;
}

Prevention

Supply SSL/TLS config (trustStore/keyStore) whenever endpoints use https
Keep URL scheme and client TLS config consistent in configuration files
In custom code, always build clients via the factory overload that takes an SSLContext for https targets

When it happens

Trigger: Making an https:// request through a NettyHttpClient/HttpClientInit client created without SSL (e.g. HttpClientInit.createClient with null sslContext, or config that did not provide a keystore/truststore so no SSLContext was built).

Common situations: Pointing a Druid config (e.g. druid.host or downstream URL) at https while the client-side TLS config (trustStore, keyStore properties) is absent; using the plain-client constructor in custom extension code; environments where TLS was recently enabled server-side but not on the client.

Related errors

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/04aef24d8d5d2bad. Report an issue: GitHub.

Appendix: source

Thrown at processing/src/main/java/org/apache/druid/java/util/http/client/pool/ChannelResourceFactory.java:203

                  }
                }
            );
          } else {
            connectFuture.setFailure(
                new ChannelException(
                    StringUtils.format("Problem connecting to proxy[%s]", proxyUri), f1.getCause()
                )
            );
          }
        }
      });
    } else {
      connectFuture = bootstrap.connect(new InetSocketAddress(host, port));
    }

    if ("https".equals(url.getProtocol())) {
      if (sslContext == null) {
        throw new IllegalStateException("No sslContext set, cannot do https");
      }

      final SSLEngine sslEngine = sslContext.createSSLEngine(host, port);
      final SSLParameters sslParameters = new SSLParameters();
      sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
      sslEngine.setSSLParameters(sslParameters);
      sslEngine.setUseClientMode(true);
      final SslHandler sslHandler = new SslHandler(
          sslEngine,
          SslHandler.getDefaultBufferPool(),
          false,
          timer,
          sslHandshakeTimeout
      );

      // https://github.com/netty/netty/issues/160
      sslHandler.setCloseOnSSLException(true);

View on GitHub (pinned to 9b90983fd2)