{"record":{"id":"93fad8ad549102df","repo":"apache/druid","slug":"could-not-find-certificate-checker-with-type-che","errorCode":null,"errorMessage":"Could not find certificate checker with type: <checkerType>","messagePattern":"Could not find certificate checker with type: <checkerType>","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"server/src/main/java/org/apache/druid/server/security/TLSCertificateCheckerModule.java","lineNumber":83,"sourceCode":"    private TLSCertificateChecker checker = null;\n\n    public TLSCertificateCheckerProvider(\n        String checkerType\n    )\n    {\n      this.checkerType = checkerType;\n    }\n\n    @Inject\n    public void inject(Injector injector)\n    {\n      final List<Binding<TLSCertificateChecker>> checkerBindings = injector.findBindingsByType(new TypeLiteral<>()\n      {\n      });\n\n      checker = findChecker(checkerType, checkerBindings);\n      if (checker == null) {\n        throw new IAE(\"Could not find certificate checker with type: \" + checkerType);\n      }\n    }\n\n    @Override\n    public TLSCertificateChecker get()\n    {\n      if (checker == null) {\n        throw new ISE(\"Checker was null, that's bad!\");\n      }\n      return checker;\n    }\n\n    private TLSCertificateChecker findChecker(\n        String checkerType,\n        List<Binding<TLSCertificateChecker>> checkerBindings\n    )\n    {\n      for (Binding<TLSCertificateChecker> binding : checkerBindings) {","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/server/src/main/java/org/apache/druid/server/security/TLSCertificateCheckerModule.java#L65-L101","documentation":"TLSCertificateCheckerModule's CheckedProvider cannot resolve a TLSCertificateChecker bound to the requested checkerType among the Guice bindings; it throws IAE \"Could not find certificate checker with type: <checkerType>\". Druid supports pluggable TLS certificate checkers identified by a string type in client TLS config.","triggerScenarios":"Setting druid.client.https.certificateChecker (or equivalent TLS config) to a type string with no matching TLSCertificateChecker Guice binding (no extension providing it and not a built-in type).","commonSituations":"Typo in the checker type; using a checker provided by an extension that is not loaded; copying config from a cluster with an extra TLS extension installed.","solutions":["Correct the checker type string in the TLS config to a built-in or extension-provided type.","Load the extension that provides the TLSCertificateChecker (add to druid.extensions.loadList).","Verify the extension registers its checker binding in TLSCertificateCheckerModule.","Restart the service after the change."],"exampleFix":"// before\n// druid.client.https.certificateChecker = CertCheckerHighAssurance // not bound\n// after\n// druid.client.https.certificateChecker = hostnameVerification","handlingStrategy":"validation","validationCode":"// Verify the checker type is bound before starting services that use TLS\nfinal List<Binding<TLSCertificateChecker>> bindings = injector.findBindingsByType(new TypeLiteral<TLSCertificateChecker>() {});\nboolean ok = bindings.stream().anyMatch(b -> checkerType.equals(b.getProvider().getKey().getAnnotationValue()));","typeGuard":null,"tryCatchPattern":"try { injector.getInstance(TLSCertificateChecker.class); }\ncatch (IAE e) { if (e.getMessage().startsWith(\"Could not find certificate checker\")) { failStartupWithConfigHint(e); } else { throw e; } }","preventionTips":["Only use certificate checker types documented by loaded extensions.","List druid.extensions.loadList alongside TLS config and keep them consistent.","Smoke-test HTTPS client connectivity after any TLS config change."],"tags":["tls","guice","config","certificate"],"backgroundTag":"invalid-config-value","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}