What causes "Unable to load TrustStore" in apache/druid?

Check the Druid process logs and file system: verify the trustStorePath exists and is readable by the Druid user on every node.

apache/druid · error · IllegalStateException

Unable to load TrustStore

Error message

Unable to load TrustStore

What it means

This error is thrown when loading the trust store file or initializing the SSL context for an https InfluxDB emitter fails. The catch block wraps every Exception from opening/reading the KeyStore file, instantiating the KeyStore type, or initializing SSLContext, replaces the original exception with an IllegalStateException whose message does not include the cause, so the underlying reason (bad path, wrong password, corrupt file, unknown type) is lost.

Source

Thrown at extensions-contrib/influxdb-emitter/src/main/java/org/apache/druid/emitter/influxdb/InfluxdbEmitter.java:243

      SSLContext sslContext;
      if (influxdbEmitterConfig.getTrustStorePath() == null || influxdbEmitterConfig.getTrustStorePassword() == null) {
        String msg = "Can't load TrustStore. Truststore path or password is not set.";
        log.error(msg);
        throw new IllegalStateException(msg);
      }

      try (FileInputStream in = new FileInputStream(new File(influxdbEmitterConfig.getTrustStorePath()))) {
        KeyStore store = KeyStore.getInstance(influxdbEmitterConfig.getTrustStoreType());
        store.load(in, influxdbEmitterConfig.getTrustStorePassword().toCharArray());
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(store);
        sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, tmf.getTrustManagers(), null);
      }
      catch (Exception ex) {
        String msg = "Unable to load TrustStore";
        log.error(msg);
        throw new IllegalStateException(msg);
      }
      return HttpClients.custom().setSSLContext(sslContext).setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE).build();
    } else {
      return HttpClientBuilder.create().build();
    }
  }

}

View on GitHub (pinned to 9b90983fd2)

Solutions

Check the Druid process logs and file system: verify the trustStorePath exists and is readable by the Druid user on every node.
Confirm trustStorePassword matches the actual key store password and trustStoreType matches the file format (JKS vs PKCS12).
Regenerate or re-export the trust store file if it is corrupt; test loading it standalone with keytool -list -keystore.
Temporarily catch and log the cause locally or inspect the file with keytool to identify the exact underlying exception, since the message swallows it.

Example fix

// before (diagnosis)
keytool -list -keystore /path/to/truststore.jks -storepass changeit
// after (config matching the actual file)
druid.emitter.influxdb.trustStorePath=/etc/druid/truststore.jks
druid.emitter.influxdb.trustStoreType=JKS
druid.emitter.influxdb.trustStorePassword=changeit

Defensive patterns

Strategy: try-catch

Validate before calling

// pre-validate the trust store before configuring the emitter
File ts = new File(cfg.getTrustStorePath());
if (!ts.isFile() || !ts.canRead()) throw new IllegalStateException("trust store missing/unreadable: " + ts);
try (FileInputStream in = new FileInputStream(ts)) {
  KeyStore ks = KeyStore.getInstance(cfg.getTrustStoreType());
  ks.load(in, cfg.getTrustStorePassword().toCharArray()); // fails fast with real cause
}

Try / catch

try {
  // emitter creation / https config
} catch (IllegalStateException e) {
  log.error("InfluxDB emitter trust store could not be loaded; check path, password, and type", e);
  // fall back to http or disable the emitter
}

Prevention

Preload the trust store with keytool during deployment to verify path/password/type.
Match trustStoreType to the file format (JKS vs PKCS12), especially on Java 9+.
Ensure the Druid service user has read permission on the trust store on every node.
Note the thrown message swallows the cause; validate the store yourself to surface the real error.

When it happens

Trigger: buildInfluxdbClient succeeds the null checks but then: the trustStorePath does not point to an existing file (FileInputStream throws FileNotFoundException); the password is wrong; the trustStoreType string is not a valid KeyStore type (e.g. "JKS" vs "PKCS12"); the file is corrupt or in the wrong format; or SSLContext.getInstance("TLS") fails on the JVM.

Common situations: Typo in the trust store path or the file not shipped to all Druid nodes; wrong trust store password after rotation; Java 9+ defaulting to PKCS12 while the file is JKS format; file permissions preventing the Druid process from reading the trust store.

Understand the failure class

Background: "failed to read file", EACCES, ENOENT and "could not read <path>" errors: when a program can't read a file from disk — this error's family across 49 libraries.

Related errors

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/1f87cb3aefc42bf6. Report an issue: GitHub.