DRUID With TLS is not working

[suchi186]

Below are the configuration done to enable druid TLS
master:
druidPort: 8081
druidTlsPort: 8281
runtimeProperties: |
druid.serviceScheme=https
druid.enablePlaintextPort=true
druid.enableTlsPort=true
druid.tlsPort=8281
druid.server.https.port=8281
druid.server.http.port=8081
livenessProbe:
httpGet:
scheme: HTTP
path: /status/health
port: 8081
initialDelaySeconds: 30
periodSeconds: 15
timeoutSeconds: 5
successThreshold: 1
failureThreshold: 3
readinessProbe:
httpGet:
scheme: HTTP
path: /status/health
port: 8081
initialDelaySeconds: 30
periodSeconds: 10
timeoutSeconds: 5
successThreshold: 1
failureThreshold: 3
startupProbe:
httpGet:
scheme: HTTP
path: /status/health
port: 8081
initialDelaySeconds: 60
periodSeconds: 10
timeoutSeconds: 5
successThreshold: 1

router:
druidPort: 8888
druidTlsPort: 9088
runtimeProperties: |
druid.serviceScheme=https
druid.enablePlaintextPort=true
druid.enableTlsPort=true
druid.tlsPort=9088
druid.server.https.port=9088
druid.server.http.port=8888

  druid.service=druid/router

broker:
druidPort: 8082
druidTlsPort: 8282
runtimeProperties: |
druid.serviceScheme=https
druid.enablePlaintextPort=true
druid.enableTlsPort=true
druid.tlsPort=8282
druid.server.https.port=8282
druid.server.http.port=8082

  druid.service=druid/broker

indexer:
druidPort: 8091
druidTlsPort: 8291
runtimeProperties: |
druid.serviceScheme=https
druid.enablePlaintextPort=true
druid.enableTlsPort=true
druid.tlsPort=8291
druid.server.https.enable=true
druid.server.https.port=8291
druid.server.http.enable=true
druid.server.http.port=8091
druid.indexer.server.enable=true

  druid.service=druid/indexer

historical:
druidPort: 8083
druidTlsPort: 8283
runtimeProperties: |
druid.serviceScheme=https
druid.enablePlaintextPort=true
druid.enableTlsPort=true
druid.tlsPort=8283
druid.server.https.port=8283
druid.server.http.port=8083

  druid.service=druid/historical

with this configuration only master is coming up not other pods also pods are not opening the configured TLS port.

Error:-
2025-10-13T06:00:38,399 DEBUG [main] org.apache.druid.java.util.http.client.pool.ChannelResourceFactory - Generating: https://10.137.2.55:8281
2025-10-13T06:00:38,399 WARN [main] org.apache.druid.java.util.common.RetryUtils - Retrying (7 of 9) in 46,368ms.
java.lang.IllegalStateException: No sslContext set, cannot do https
at org.apache.druid.java.util.http.client.pool.ChannelResourceFactory.generate(ChannelResourceFactory.java:203) ~[druid-processing-30.0.1.jar:30.0.1]
avax.net.ssl|ERROR|05|HttpClient-Netty-Worker-45|2025-10-13 06:02:20.823 GMT|TransportContext.java:370|Fatal (CERTIFICATE_UNKNOWN): No subject alternative names matching IP address 10.137.2.55 found (
"throwable" : {
java.security.cert.CertificateException: No subject alternative names matching IP address 10.137.2.55 found
at java.base/sun.security.util.HostnameChecker.matchIP(HostnameChecker.java:165)
at java.base/sun.security.util.HostnameChecker.match(HostnameChecker.java:101)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:458)

[schmichri]

How did you create the Certificates?

[schmichri]

I had this documented a while ago how to create proper Certs: https://www.iunera.com/kraken/big-data-lessons/installing-a-production-ready-apache-druid-cluster-on-kubernetes-part-2-druid-deployment-preparation/#configure-tls-certificates-keystore-and-truststore
Important is that you setup the subjectAltNames poperly. In the example its -dname "CN=druid" parameters. And then you have to modify the truststore.
https://github.com/iunera/druid-cluster-config/blob/main/README.md (leave a star)

And don't forget to disable hostnameValidationdruid.client.https.validateHostnames=false and druid.server.https.validateHostnames=false

[suchi186]

How did you create the Certificates?

using crt manager
{{- if .Values.certificates.enabled }}

apiVersion: cert-manager.io/v1
kind: Certificate

metadata:
name: "{{ include "druid-cluster.certificates.name" (merge (dict "Release" .Release) .) }}"
namespace: {{ .Release.Namespace }}
#labels: add this in future
spec:
commonName: "{{ include "druid-cluster.certificates.commonName" (merge (dict "Release" .Release) .) }}"
dnsNames:
- 127.0.0.1
- "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local"
- ".{{ .Release.Name }}-brokers.{{ .Release.Namespace }}.svc.cluster.local"
- ".{{ .Release.Name }}-coordinators.{{ .Release.Namespace }}.svc.cluster.local"
- ".{{ .Release.Name }}-historicals.{{ .Release.Namespace }}.svc.cluster.local"
- ".{{ .Release.Name }}-indexer.{{ .Release.Namespace }}.svc.cluster.local"
- "*.{{ .Release.Name }}-routers.{{ .Release.Namespace }}.svc.cluster.local"
duration: {{ .Values.certificates.duration}}
renewBefore: {{ .Values.certificates.renewBefore}}
issuerRef:
kind: ClusterIssuer
name: {{ .Values.certificates.issuerRef.name }}
group: {{ .Values.certificates.issuerRef.group }}
secretName: "{{ include "druid-cluster.certificates.secretName" (merge (dict "Release" .Release) .) }}"
usages:
- server auth
- client auth
{{- if (ne ( include "druid-cluster.tls.keyStoreType" . ) "PEM") }}
keystores:
jks:
create: true
# Password used to encrypt the keystore
passwordSecretRef:
key: {{ include "druid-cluster.certManager.keystorePasswordKey" . }}
name: {{ include "druid-cluster.certManager.keystorePasswordSecret" . }}
{{- end }}
{{- if (ne ( include "druid-cluster.tls.trustStoreType" . ) "PEM") }}
truststores:
jks:
create: true
# Password used to encrypt the keystore
passwordSecretRef:
key: {{ include "druid-cluster.certManager.truststorePasswordKey" . }}
name: {{ include "druid-cluster.certManager.truststorePasswordSecret" . }}
{{- end }}

#keyUsage:

- digitalSignature

- keyEncipherment

#subject:

organizations:

- {{ .Values.certificates.organizations }}

countries:

- {{ .Values.certificates.countries }}

localities:

- {{ .Values.certificates.localities }}

provinces:

- {{ .Values.certificates.provinces }}

#commonName: "{{ include "druid-cluster.certificates.commonName" (merge (dict "Release" .Release) .) }}"
{{- end }}

[suchi186]

How did you create the Certificates?

Hi can you pls check what am i missing here.