{"record":{"id":"04aef24d8d5d2bad","repo":"apache/druid","slug":"no-sslcontext-set-cannot-do-https","errorCode":null,"errorMessage":"No sslContext set, cannot do https","messagePattern":"No sslContext set, cannot do https","errorType":"error_code","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"processing/src/main/java/org/apache/druid/java/util/http/client/pool/ChannelResourceFactory.java","lineNumber":203,"sourceCode":"                  }\n                }\n            );\n          } else {\n            connectFuture.setFailure(\n                new ChannelException(\n                    StringUtils.format(\"Problem connecting to proxy[%s]\", proxyUri), f1.getCause()\n                )\n            );\n          }\n        }\n      });\n    } else {\n      connectFuture = bootstrap.connect(new InetSocketAddress(host, port));\n    }\n\n    if (\"https\".equals(url.getProtocol())) {\n      if (sslContext == null) {\n        throw new IllegalStateException(\"No sslContext set, cannot do https\");\n      }\n\n      final SSLEngine sslEngine = sslContext.createSSLEngine(host, port);\n      final SSLParameters sslParameters = new SSLParameters();\n      sslParameters.setEndpointIdentificationAlgorithm(\"HTTPS\");\n      sslEngine.setSSLParameters(sslParameters);\n      sslEngine.setUseClientMode(true);\n      final SslHandler sslHandler = new SslHandler(\n          sslEngine,\n          SslHandler.getDefaultBufferPool(),\n          false,\n          timer,\n          sslHandshakeTimeout\n      );\n\n      // https://github.com/netty/netty/issues/160\n      sslHandler.setCloseOnSSLException(true);\n","sourceCodeStart":185,"sourceCodeEnd":221,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/processing/src/main/java/org/apache/druid/java/util/http/client/pool/ChannelResourceFactory.java#L185-L221","documentation":"ChannelResourceFactory creates Netty channels for pooled HTTP connections. For https URLs it needs an SSLContext to build an SSLEngine; if the client was constructed without one, generate() throws IllegalStateException — https is simply not configured on this client instance.","triggerScenarios":"Making an https:// request through a NettyHttpClient/HttpClientInit client created without SSL (e.g. HttpClientInit.createClient with null sslContext, or config that did not provide a keystore/truststore so no SSLContext was built).","commonSituations":"Pointing a Druid config (e.g. druid.host or downstream URL) at https while the client-side TLS config (trustStore, keyStore properties) is absent; using the plain-client constructor in custom extension code; environments where TLS was recently enabled server-side but not on the client.","solutions":["Configure the client with an SSLContext: supply TLS settings (trustStore/keyStore path & password, or a custom SSLContext) so HttpClientInit builds an SSL-enabled client.","If TLS is not intended, change the target URL scheme from https:// to http://.","For custom code, call the client factory overload that accepts a non-null SSLContext.","Verify the TLS config properties are actually read (correct config file/section, no typos) so the client is created with sslContext != null."],"exampleFix":"// before\nHttpClient client = HttpClientInit.createClient(new HttpClientConfig(HttpClientConfig.builder().build()), lifecycle);\n// https:// request -> IllegalStateException: No sslContext set\n// after\nSSLContext sslContext = SimpleSSLSocketFactory.getSSLContextFromKeystores(trustPath, trustPassword, keyPath, keyPassword);\nHttpClient client = HttpClientInit.createClient(\n  new HttpClientConfig(HttpClientConfig.builder().setSslContext(sslContext).build()), lifecycle);","handlingStrategy":"validation","validationCode":"if (\"https\".equals(url.getProtocol()) && sslContext == null) {\n  throw new IllegalStateException(\"Configure TLS (trust/key stores) before using https URLs\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  return client.go(request, handler, returnValueAccumulator);\n} catch (IllegalStateException e) {\n  if (e.getMessage().contains(\"No sslContext set\")) {\n    throw new RuntimeException(\"https requested but client has no SSLContext; configure TLS settings\", e);\n  }\n  throw e;\n}","preventionTips":["Supply SSL/TLS config (trustStore/keyStore) whenever endpoints use https","Keep URL scheme and client TLS config consistent in configuration files","In custom code, always build clients via the factory overload that takes an SSLContext for https targets"],"tags":["https","ssl","http-client","configuration"],"backgroundTag":"authentication-required","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}