{"record":{"id":"3a06efb8118df1a3","repo":"apache/druid","slug":"failed-to-configure-tls-for-openlineage-http-trans","errorCode":null,"errorMessage":"Failed to configure TLS for OpenLineage HTTP transport","messagePattern":"Failed to configure TLS for OpenLineage HTTP transport","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions-contrib/openlineage-emitter/src/main/java/org/apache/druid/extensions/openlineage/OpenLineageRequestLoggerProvider.java","lineNumber":168,"sourceCode":"          KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());\n          // Resolve once to avoid inconsistent values if the provider is dynamic.\n          String rawKeyPw = keyStorePassword != null ? keyStorePassword.getPassword() : null;\n          char[] keyPwChars = rawKeyPw != null ? rawKeyPw.toCharArray() : null;\n          keyStore.load(in, keyPwChars);\n          kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());\n          kmf.init(keyStore, keyPwChars);\n        }\n      }\n      SSLContext sslContext = SSLContext.getInstance(\"TLS\");\n      sslContext.init(\n          kmf != null ? kmf.getKeyManagers() : null,\n          tmf != null ? tmf.getTrustManagers() : null,\n          null\n      );\n      return builder.setSSLContext(sslContext).build();\n    }\n    catch (Exception e) {\n      throw new IllegalStateException(\"Failed to configure TLS for OpenLineage HTTP transport\", e);\n    }\n  }\n}\n","sourceCodeStart":150,"sourceCodeEnd":172,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-contrib/openlineage-emitter/src/main/java/org/apache/druid/extensions/openlineage/OpenLineageRequestLoggerProvider.java#L150-L172","documentation":"OpenLineageRequestLoggerProvider.buildHttpClient sets up an SSLContext from the configured truststore/keystore for the HTTP transport. Any exception during TLS setup (bad keystore path, wrong password, unsupported algorithm) is wrapped in IllegalStateException with this message.","triggerScenarios":"Configuring druid.request.logging TLS properties (truststore path/password/type) that cannot be loaded: file missing, invalid password, malformed PKCS12/JKS store, or unavailable TLS algorithm; triggered lazily when the provider builds the shared HTTP client.","commonSituations":"Pointing at a non-existent or unreadable truststore file, copy-pasting a password with trailing whitespace, using a store type unsupported by the JVM, or a PEM file supplied where a keystore is expected.","solutions":["Verify the truststore/keystore file path exists and is readable by the Druid process","Confirm store passwords and types (JKS/PKCS12) match the actual file format","Test loading the store with `keytool -list -keystore <path>` using the configured password","If no custom TLS is needed, remove the TLS properties so the default client is used"],"exampleFix":"// before\nssl.trustStorePath=/etc/druid/truststore.jks  (file missing)\n// after\nssl.trustStorePath=/etc/druid/certs/truststore.p12\nssl.trustStoreType=PKCS12\nssl.trustStorePassword=<correct-password>","handlingStrategy":"try-catch","validationCode":"File ks = new File(trustStorePath);\nif (ks.exists() && ks.canRead() && password != null) {\n  KeyStore.getInstance(new FileInputStream(ks), password.toCharArray()); // fail fast outside service startup\n}","typeGuard":null,"tryCatchPattern":"try { provider.httpClient(); } catch (IllegalStateException e) { if (e.getCause() != null) { inspectTlsCause(e.getCause()); } }","preventionTips":["Verify keystore/truststore paths, passwords, and types with keytool before deployment","Ensure the Druid process user can read TLS files","Keep store type (JKS vs PKCS12) consistent with the file format"],"tags":["java","tls","http-client","openlineage"],"backgroundTag":"invalid-config-value","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}