{"record":{"id":"3257dafbfed15d0d","repo":"apache/druid","slug":"can-t-load-truststore-truststore-path-or-password","errorCode":null,"errorMessage":"Can't load TrustStore. Truststore path or password is not set.","messagePattern":"Can't load TrustStore\\. Truststore path or password is not set\\.","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions-contrib/influxdb-emitter/src/main/java/org/apache/druid/emitter/influxdb/InfluxdbEmitter.java","lineNumber":229,"sourceCode":"\n  public void transformAndSendToInfluxdb(LinkedBlockingQueue<ServiceMetricEvent> eventsQueue)\n  {\n    StringBuilder payload = new StringBuilder();\n    int initialQueueSize = eventsQueue.size();\n    for (int i = 0; i < initialQueueSize; i++) {\n      payload.append(transformForInfluxSystems(eventsQueue.poll()));\n    }\n    postToInflux(payload.toString());\n  }\n\n  private HttpClient buildInfluxdbClient()\n  {\n    if (\"https\".equals(influxdbEmitterConfig.getProtocol())) {\n      SSLContext sslContext;\n      if (influxdbEmitterConfig.getTrustStorePath() == null || influxdbEmitterConfig.getTrustStorePassword() == null) {\n        String msg = \"Can't load TrustStore. Truststore path or password is not set.\";\n        log.error(msg);\n        throw new IllegalStateException(msg);\n      }\n\n      try (FileInputStream in = new FileInputStream(new File(influxdbEmitterConfig.getTrustStorePath()))) {\n        KeyStore store = KeyStore.getInstance(influxdbEmitterConfig.getTrustStoreType());\n        store.load(in, influxdbEmitterConfig.getTrustStorePassword().toCharArray());\n        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());\n        tmf.init(store);\n        sslContext = SSLContext.getInstance(\"TLS\");\n        sslContext.init(null, tmf.getTrustManagers(), null);\n      }\n      catch (Exception ex) {\n        String msg = \"Unable to load TrustStore\";\n        log.error(msg);\n        throw new IllegalStateException(msg);\n      }\n      return HttpClients.custom().setSSLContext(sslContext).setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE).build();\n    } else {\n      return HttpClientBuilder.create().build();","sourceCodeStart":211,"sourceCodeEnd":247,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-contrib/influxdb-emitter/src/main/java/org/apache/druid/emitter/influxdb/InfluxdbEmitter.java#L211-L247","documentation":"This error is thrown when an InfluxDB emitter is configured to use the https protocol but the trust store path or trust store password is not set in the emitter configuration. A TLS connection to InfluxDB requires a trust store containing the server certificate's CA, and without a path or password the SSL context cannot be built, so the emitter fails fast with an IllegalStateException instead of attempting an insecure or broken connection.","triggerScenarios":"Calling buildInfluxdbClient when influxdbEmitterConfig.getProtocol() equals \"https\" while either getTrustStorePath() or getTrustStorePassword() returns null, e.g. the druid.emitter.influxdb.trustStorePath or trustStorePassword runtime property was omitted from the configuration.","commonSituations":"Operators switch the emitter protocol from http to https but forget to add the trustStore properties; configuration is loaded from a properties file where the password key is missing or misspelled; secrets are injected via environment variables that are unset in the target environment.","solutions":["Set both druid.emitter.influxdb.trustStorePath and druid.emitter.influxdb.trustStorePassword in the emitter config.","Verify the protocol value: if TLS client-auth to a well-known CA is not required, use protocol \"http\" instead.","Confirm the config properties file actually contains the keys (check for typos and that the file is the one being loaded).","If the password is provisioned via env var or secret store, verify it is non-null at runtime in the target environment."],"exampleFix":"// before\ndruid.emitter.influxdb.protocol=https\n// after\ndruid.emitter.influxdb.protocol=https\ndruid.emitter.influxdb.trustStorePath=/path/to/truststore.jks\ndruid.emitter.influxdb.trustStorePassword=changeit","handlingStrategy":"validation","validationCode":"// before enabling https emitter\nif (\"https\".equals(cfg.getProtocol())) {\n  if (cfg.getTrustStorePath() == null || cfg.getTrustStorePassword() == null) {\n    throw new IllegalArgumentException(\"trustStorePath and trustStorePassword are required for https protocol\");\n  }\n  if (!new File(cfg.getTrustStorePath()).canRead()) {\n    throw new IllegalArgumentException(\"trust store not readable: \" + cfg.getTrustStorePath());\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set both trustStorePath and trustStorePassword whenever protocol is https.","Validate emitter configs at startup with a config-check step before the emitter is used.","Keep trust store paths identical on all Druid nodes (configuration management).","Provision passwords via secret management so they are never null."],"tags":["ssl","tls","configuration","influxdb","java"],"backgroundTag":"missing-required-config-field","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}