{"record":{"id":"714165bc4f017e1c","repo":"apache/druid","slug":"no-supported-protocols-found-supported-protocols","errorCode":null,"errorMessage":"No supported protocols found, supported protocols [%s], configured protocols include list: [%s] exclude list: [%s]","messagePattern":"No supported protocols found, supported protocols \\[(.+?)\\], configured protocols include list: \\[(.+?)\\] exclude list: \\[(.+?)\\]","errorType":"validation","errorClass":"IllegalStateException","httpStatus":null,"severity":"critical","filePath":"server/src/main/java/org/apache/druid/server/initialization/jetty/JettyServerModule.java","lineNumber":433,"sourceCode":"          @Override\n          public void start() throws Exception\n          {\n            log.debug(\"Starting Jetty Server...\");\n            server.start();\n            if (node.isEnableTlsPort()) {\n              // Perform validation\n              Preconditions.checkNotNull(sslContextFactory);\n              final SSLEngine sslEngine = sslContextFactory.newSSLEngine();\n              if (sslEngine.getEnabledCipherSuites() == null || sslEngine.getEnabledCipherSuites().length == 0) {\n                throw new ISE(\n                    \"No supported cipher suites found, supported suites [%s], configured suites include list: [%s] exclude list: [%s]\",\n                    Arrays.toString(sslEngine.getSupportedCipherSuites()),\n                    tlsServerConfig.getIncludeCipherSuites(),\n                    tlsServerConfig.getExcludeCipherSuites()\n                );\n              }\n              if (sslEngine.getEnabledProtocols() == null || sslEngine.getEnabledProtocols().length == 0) {\n                throw new ISE(\n                    \"No supported protocols found, supported protocols [%s], configured protocols include list: [%s] exclude list: [%s]\",\n                    Arrays.toString(sslEngine.getSupportedProtocols()),\n                    tlsServerConfig.getIncludeProtocols(),\n                    tlsServerConfig.getExcludeProtocols()\n                );\n              }\n            }\n          }\n\n          @Override\n          public void stop()\n          {\n            try {\n              final long unannounceDelay = config.getUnannouncePropagationDelay().toStandardDuration().getMillis();\n              if (unannounceDelay > 0) {\n                log.info(\"Sleeping %s ms for unannouncement to propagate.\", unannounceDelay);\n                Thread.sleep(unannounceDelay);\n              } else {","sourceCodeStart":415,"sourceCodeEnd":451,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/server/src/main/java/org/apache/druid/server/initialization/jetty/JettyServerModule.java#L415-L451","documentation":"During Jetty server startup with TLS enabled, Druid configures the SSL engine with the include/exclude protocol lists from the TLS server config. If after applying those filters the enabled protocol list is empty, no TLS connection could ever succeed, so start() throws this IllegalStateException listing the JVM's supported protocols and the configured include/exclude lists.","triggerScenarios":"Starting a Druid node with druid.server.https configured where the includeProtocols list names protocols the JVM/TLS provider does not support, or excludeProtocols filters out every protocol the engine supports (e.g. excluding TLSv1.2 and TLSv1.3 on a JVM that only supports those).","commonSituations":"Hardening configs that exclude all legacy protocols without including modern ones; older JVMs that lack TLSv1.3 while the config requires it; typos in protocol names in the config.","solutions":["Inspect the error's 'supported protocols' list and fix druid.server.https.includeProtocols/excludeProtocols so at least one supported protocol remains enabled.","Typical safe config: exclude SSLv2Hello, SSLv3, TLSv1, TLSv1.1 and include TLSv1.2 and TLSv1.3.","Upgrade the JVM if a required protocol (e.g. TLSv1.3) is not in the supported list.","Correct protocol-name typos in the runtime.properties TLS config."],"exampleFix":"// before (runtime.properties)\ndruid.server.https.excludeProtocols=TLSv1.2,TLSv1.3\n// after\ndruid.server.https.excludeProtocols=SSLv2Hello,SSLv3,TLSv1,TLSv1.1","handlingStrategy":"validation","validationCode":"// Before startup, ensure at least one configured protocol is plausible:\nconst common = ['TLSv1.2', 'TLSv1.3'];\nif (config.excludeProtocols.includes('TLSv1.2') && config.excludeProtocols.includes('TLSv1.3')) {\n  throw new Error('TLS config excludes all modern protocols; at least one must remain enabled');\n}","typeGuard":"function leavesAtLeastOneProtocol(include, exclude) {\n  return include.length === 0 || include.some(p => !exclude.includes(p));\n}","tryCatchPattern":"try {\n  injector.getInstance(Lifecycle.class).start();\n} catch (IllegalStateException e) {\n  if (e.getMessage().startsWith(\"No supported protocols found\")) {\n    log.fatal(\"Fix druid.server.https include/excludeProtocols: %s\", e.getMessage());\n  } else { throw e; }\n}","preventionTips":["Only exclude legacy protocols (SSLv3, TLSv1, TLSv1.1); never exclude both TLSv1.2 and TLSv1.3.","Cross-check configured protocol names against the JVM's supported list (sslEngine.getSupportedProtocols()) for your JDK.","Test TLS startup with the exact JDK image you deploy before rolling out hardened configs."],"tags":["tls","ssl","startup","configuration","jetty"],"backgroundTag":"invalid-config-value","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}