{"record":{"id":"1f87cb3aefc42bf6","repo":"apache/druid","slug":"unable-to-load-truststore","errorCode":null,"errorMessage":"Unable to load TrustStore","messagePattern":"Unable to load TrustStore","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions-contrib/influxdb-emitter/src/main/java/org/apache/druid/emitter/influxdb/InfluxdbEmitter.java","lineNumber":243,"sourceCode":"      SSLContext sslContext;\n      if (influxdbEmitterConfig.getTrustStorePath() == null || influxdbEmitterConfig.getTrustStorePassword() == null) {\n        String msg = \"Can't load TrustStore. Truststore path or password is not set.\";\n        log.error(msg);\n        throw new IllegalStateException(msg);\n      }\n\n      try (FileInputStream in = new FileInputStream(new File(influxdbEmitterConfig.getTrustStorePath()))) {\n        KeyStore store = KeyStore.getInstance(influxdbEmitterConfig.getTrustStoreType());\n        store.load(in, influxdbEmitterConfig.getTrustStorePassword().toCharArray());\n        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\n        tmf.init(store);\n        sslContext = SSLContext.getInstance(\"TLS\");\n        sslContext.init(null, tmf.getTrustManagers(), null);\n      }\n      catch (Exception ex) {\n        String msg = \"Unable to load TrustStore\";\n        log.error(msg);\n        throw new IllegalStateException(msg);\n      }\n      return HttpClients.custom().setSSLContext(sslContext).setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE).build();\n    } else {\n      return HttpClientBuilder.create().build();\n    }\n  }\n\n}\n","sourceCodeStart":225,"sourceCodeEnd":252,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-contrib/influxdb-emitter/src/main/java/org/apache/druid/emitter/influxdb/InfluxdbEmitter.java#L225-L252","documentation":"This error is thrown when loading the trust store file or initializing the SSL context for an https InfluxDB emitter fails. The catch block wraps every Exception from opening/reading the KeyStore file, instantiating the KeyStore type, or initializing SSLContext, replaces the original exception with an IllegalStateException whose message does not include the cause, so the underlying reason (bad path, wrong password, corrupt file, unknown type) is lost.","triggerScenarios":"buildInfluxdbClient succeeds the null checks but then: the trustStorePath does not point to an existing file (FileInputStream throws FileNotFoundException); the password is wrong; the trustStoreType string is not a valid KeyStore type (e.g. \"JKS\" vs \"PKCS12\"); the file is corrupt or in the wrong format; or SSLContext.getInstance(\"TLS\") fails on the JVM.","commonSituations":"Typo in the trust store path or the file not shipped to all Druid nodes; wrong trust store password after rotation; Java 9+ defaulting to PKCS12 while the file is JKS format; file permissions preventing the Druid process from reading the trust store.","solutions":["Check the Druid process logs and file system: verify the trustStorePath exists and is readable by the Druid user on every node.","Confirm trustStorePassword matches the actual key store password and trustStoreType matches the file format (JKS vs PKCS12).","Regenerate or re-export the trust store file if it is corrupt; test loading it standalone with keytool -list -keystore.","Temporarily catch and log the cause locally or inspect the file with keytool to identify the exact underlying exception, since the message swallows it."],"exampleFix":"// before (diagnosis)\nkeytool -list -keystore /path/to/truststore.jks -storepass changeit\n// after (config matching the actual file)\ndruid.emitter.influxdb.trustStorePath=/etc/druid/truststore.jks\ndruid.emitter.influxdb.trustStoreType=JKS\ndruid.emitter.influxdb.trustStorePassword=changeit","handlingStrategy":"try-catch","validationCode":"// pre-validate the trust store before configuring the emitter\nFile ts = new File(cfg.getTrustStorePath());\nif (!ts.isFile() || !ts.canRead()) throw new IllegalStateException(\"trust store missing/unreadable: \" + ts);\ntry (FileInputStream in = new FileInputStream(ts)) {\n  KeyStore ks = KeyStore.getInstance(cfg.getTrustStoreType());\n  ks.load(in, cfg.getTrustStorePassword().toCharArray()); // fails fast with real cause\n}","typeGuard":null,"tryCatchPattern":"try {\n  // emitter creation / https config\n} catch (IllegalStateException e) {\n  log.error(\"InfluxDB emitter trust store could not be loaded; check path, password, and type\", e);\n  // fall back to http or disable the emitter\n}","preventionTips":["Preload the trust store with keytool during deployment to verify path/password/type.","Match trustStoreType to the file format (JKS vs PKCS12), especially on Java 9+.","Ensure the Druid service user has read permission on the trust store on every node.","Note the thrown message swallows the cause; validate the store yourself to surface the real error."],"tags":["ssl","tls","keystore","influxdb","java"],"backgroundTag":"file-read-failed","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}