apache/druid · critical · IllegalStateException

No supported protocols found, supported protocols [%s], conf

Error message

No supported protocols found, supported protocols [%s], configured protocols include list: [%s] exclude list: [%s]

What it means

During Jetty server startup with TLS enabled, Druid configures the SSL engine with the include/exclude protocol lists from the TLS server config. If after applying those filters the enabled protocol list is empty, no TLS connection could ever succeed, so start() throws this IllegalStateException listing the JVM's supported protocols and the configured include/exclude lists.

Source

Thrown at server/src/main/java/org/apache/druid/server/initialization/jetty/JettyServerModule.java:433

          @Override
          public void start() throws Exception
          {
            log.debug("Starting Jetty Server...");
            server.start();
            if (node.isEnableTlsPort()) {
              // Perform validation
              Preconditions.checkNotNull(sslContextFactory);
              final SSLEngine sslEngine = sslContextFactory.newSSLEngine();
              if (sslEngine.getEnabledCipherSuites() == null || sslEngine.getEnabledCipherSuites().length == 0) {
                throw new ISE(
                    "No supported cipher suites found, supported suites [%s], configured suites include list: [%s] exclude list: [%s]",
                    Arrays.toString(sslEngine.getSupportedCipherSuites()),
                    tlsServerConfig.getIncludeCipherSuites(),
                    tlsServerConfig.getExcludeCipherSuites()
                );
              }
              if (sslEngine.getEnabledProtocols() == null || sslEngine.getEnabledProtocols().length == 0) {
                throw new ISE(
                    "No supported protocols found, supported protocols [%s], configured protocols include list: [%s] exclude list: [%s]",
                    Arrays.toString(sslEngine.getSupportedProtocols()),
                    tlsServerConfig.getIncludeProtocols(),
                    tlsServerConfig.getExcludeProtocols()
                );
              }
            }
          }

          @Override
          public void stop()
          {
            try {
              final long unannounceDelay = config.getUnannouncePropagationDelay().toStandardDuration().getMillis();
              if (unannounceDelay > 0) {
                log.info("Sleeping %s ms for unannouncement to propagate.", unannounceDelay);
                Thread.sleep(unannounceDelay);
              } else {

View on GitHub (pinned to 9b90983fd2)

Solutions

1. Inspect the error's 'supported protocols' list and fix druid.server.https.includeProtocols/excludeProtocols so at least one supported protocol remains enabled.
2. Typical safe config: exclude SSLv2Hello, SSLv3, TLSv1, TLSv1.1 and include TLSv1.2 and TLSv1.3.
3. Upgrade the JVM if a required protocol (e.g. TLSv1.3) is not in the supported list.
4. Correct protocol-name typos in the runtime.properties TLS config.

Example fix

// before (runtime.properties)
druid.server.https.excludeProtocols=TLSv1.2,TLSv1.3
// after
druid.server.https.excludeProtocols=SSLv2Hello,SSLv3,TLSv1,TLSv1.1

// Before startup, ensure at least one configured protocol is plausible:
const common = ['TLSv1.2', 'TLSv1.3'];
if (config.excludeProtocols.includes('TLSv1.2') && config.excludeProtocols.includes('TLSv1.3')) {
  throw new Error('TLS config excludes all modern protocols; at least one must remain enabled');
}

function leavesAtLeastOneProtocol(include, exclude) {
  return include.length === 0 || include.some(p => !exclude.includes(p));
}

try {
  injector.getInstance(Lifecycle.class).start();
} catch (IllegalStateException e) {
  if (e.getMessage().startsWith("No supported protocols found")) {
    log.fatal("Fix druid.server.https include/excludeProtocols: %s", e.getMessage());
  } else { throw e; }
}

When it happens

Trigger: Starting a Druid node with druid.server.https configured where the includeProtocols list names protocols the JVM/TLS provider does not support, or excludeProtocols filters out every protocol the engine supports (e.g. excluding TLSv1.2 and TLSv1.3 on a JVM that only supports those).

Common situations: Hardening configs that exclude all legacy protocols without including modern ones; older JVMs that lack TLSv1.3 while the config requires it; typos in protocol names in the config.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Can't load TrustStore. Truststore path or password is not se
• The gRPC query server requires either a Basic or Anonymous a
• Unable to load TrustStore
• Set only one of 'key' or 'sharedAccessStorageToken' or 'useA
• SQLCatalogManager only works with SQL based metadata store a

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/714165bc4f017e1c. Report an issue: GitHub.