{"record":{"id":"01c04c08d8cddbe3","repo":"apache/druid","slug":"a-valid-tlsport-needs-to-specified-when-druid-enab","errorCode":null,"errorMessage":"A valid tlsPort needs to specified when druid.enableTlsPort is set","messagePattern":"A valid tlsPort needs to specified when druid\\.enableTlsPort is set","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"server/src/main/java/org/apache/druid/server/DruidNode.java","lineNumber":200,"sourceCode":"      host = hostAndPort.getHost();\n      portFromHostConfig = hostAndPort.hasPort() ? hostAndPort.getPort() : null;\n      if (plainTextPort != null && portFromHostConfig != null && !plainTextPort.equals(portFromHostConfig)) {\n        throw new IAE(\"Conflicting host:port [%s] and port [%d] settings\", host, plainTextPort);\n      }\n      if (portFromHostConfig != null) {\n        plainTextPort = portFromHostConfig;\n      }\n    } else {\n      host = getDefaultHost();\n    }\n\n    if (enablePlaintextPort && enableTlsPort && ((plainTextPort == null || tlsPort == null)\n                                                 || plainTextPort.equals(tlsPort))) {\n      // If both plainTExt and tls are enabled then do not allow plaintextPort to be null or\n      throw new IAE(\"plaintextPort and tlsPort cannot be null or same if both http and https connectors are enabled\");\n    }\n    if (enableTlsPort && (tlsPort == null || tlsPort < 0)) {\n      throw new IAE(\"A valid tlsPort needs to specified when druid.enableTlsPort is set\");\n    }\n\n    if (enablePlaintextPort) {\n      // to preserve backwards compatible behaviour\n      if (nullHost && plainTextPort == null) {\n        plainTextPort = -1;\n      } else {\n        if (plainTextPort == null) {\n          plainTextPort = SocketUtil.findOpenPort(8080);\n        }\n      }\n      this.plaintextPort = plainTextPort;\n    } else {\n      this.plaintextPort = -1;\n    }\n    if (enableTlsPort) {\n      this.tlsPort = tlsPort;\n    } else {","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/server/src/main/java/org/apache/druid/server/DruidNode.java#L182-L218","documentation":"Configuration validation in the DruidNode initializer: when both enablePlaintextPort and enableTlsPort are true (druid.enableTlsPort set), the node must know both a plaintext and a TLS port to advertise its services, and this fires when either is null. It runs during node construction (init called from the DruidNode constructor), so a misconfigured runtime.properties (e.g. druid.port/druid.tlsPort absent while TLS is enabled) fails fast at startup; specify both ports when enabling TLS.","triggerScenarios":"druid.enableTlsPort=true with druid.tlsPort missing, or set to a negative number like -1 (which is only legal to disable the plaintext port).","commonSituations":"Enabling TLS via a global config file while per-node tlsPort keys were never added; using -1 copied from the plaintext-port disable idiom.","solutions":["Set druid.tlsPort to a valid positive port (e.g. 8281)","If TLS is not intended, set druid.enableTlsPort=false","Audit all runtime.properties for enableTlsPort=true without a matching tlsPort"],"exampleFix":"// before\n  druid.enableTlsPort=true\n  druid.tlsPort=-1\n// after\n  druid.enableTlsPort=true\n  druid.tlsPort=8281","handlingStrategy":"validation","validationCode":"if (enableTlsPort && (tlsPort == null || tlsPort < 0)) {\n  throw new IllegalArgumentException(\"Set druid.tlsPort to a positive port when druid.enableTlsPort=true\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  node = new DruidNode(service, host, true, plainPort, tlsPort, false, false);\n} catch (IllegalArgumentException e) {\n  log.fatal(\"Missing/invalid druid.tlsPort: %s\", e.getMessage());\n  throw e;\n}","preventionTips":["Never use -1 as tlsPort; -1 only disables the plaintext port","Pair every enableTlsPort=true with an explicit positive druid.tlsPort","Config-lint TLS settings per node role","Document port conventions (e.g. plaintext 8081, TLS 8281) for operators"],"tags":["configuration","druid-node","tls","ports"],"backgroundTag":"invalid-config-value","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}