{"record":{"id":"919aa734cfac2dc1","repo":"apache/druid","slug":"consul-tls-configuration-failed-refusing-to-fall","errorCode":null,"errorMessage":"Consul TLS configuration failed; refusing to fall back to HTTP","messagePattern":"Consul TLS configuration failed; refusing to fall back to HTTP","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions-contrib/consul-extensions/src/main/java/org/apache/druid/consul/discovery/ConsulClients.java","lineNumber":102,"sourceCode":"          connection.getPort()\n      );\n    }\n\n    if (tlsConfigured) {\n      try {\n        SSLContext sslContext = buildSslContext(sslConfig);\n        HttpClient httpClient = createHttpClientWithOptionalBasicAuth(sslContext, basicUser, basicPass, connection, sslConfig);\n\n        String httpsHost = \"https://\" + connection.getHost();\n\n        ConsulRawClient rawClient = new ConsulRawClient(httpsHost, connection.getPort(), httpClient);\n        LOGGER.info(\"Created Consul client with HTTPS to %s:%d\", connection.getHost(), connection.getPort());\n        return new ConsulClient(rawClient);\n      }\n      catch (Exception e) {\n        // TLS was explicitly configured; fail fast rather than silently downgrade to HTTP\n        LOGGER.error(e, \"Failed to configure TLS for Consul client (host: %s, port: %d)\", connection.getHost(), connection.getPort());\n        throw new IllegalStateException(\"Consul TLS configuration failed; refusing to fall back to HTTP\", e);\n      }\n    }\n\n    // No TLS configured - use plain HTTP\n    HttpClient httpClient = createHttpClientWithOptionalBasicAuth(null, basicUser, basicPass, connection, null);\n    String httpHost = \"http://\" + connection.getHost();\n    ConsulRawClient rawClient = new ConsulRawClient(httpHost, connection.getPort(), httpClient);\n    LOGGER.info(\"Created Consul client with HTTP to %s:%d\", connection.getHost(), connection.getPort());\n    return new ConsulClient(rawClient);\n  }\n\n  /**\n   * Build SSLContext from ConsulSSLConfig using Druid's standard TLS infrastructure.\n   */\n  private static SSLContext buildSslContext(ConsulSSLConfig config)\n  {\n    try {\n      return new TLSUtils.ClientSSLContextBuilder()","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-contrib/consul-extensions/src/main/java/org/apache/druid/consul/discovery/ConsulClients.java#L84-L120","documentation":"When connection.sslClientConfig is present, create() builds an HTTPS Consul client; if building the SSLContext or HTTP client fails, it refuses to silently fall back to plain HTTP (which could leak credentials) and aborts client creation with this message.","triggerScenarios":"Thrown at extensions-contrib/consul-extensions/src/main/java/org/apache/druid/consul/discovery/ConsulClients.java:102 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the TLS configuration (truststore/keystore paths, passwords, protocol/algorithm); the cause chain names the exact problem.","Verify truststore/keystore files exist and are readable by the Druid process.","Remove sslClientConfig only if plaintext HTTP to Consul is genuinely intended."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}