Mutual TLS support in InfluxDB3 Java Client

InfluxDB 3
1

Hi InfluxDB Community,

I’m currently integrating the InfluxDB3 Java client (v1.2.0) into Kafka Connect environments and have encountered some SSL/TLS limitations compared to the Influxdb v2 Java client and other standard HTTP clients

Current InfluxDB3 SSL Support:

  • Server certificate validation (enable/disable)

  • Custom CA certificates (PEM format only)

  • Basic TLS protocol selection (v1.2/v1.3)

Missing Enterprise Features:

  • Mutual TLS (mTLS) - No client certificate authentication support

  • Multiple certificate formats - Only PEM supported, no JKS/PKCS12

  • Keystore support - Cannot load client certificates from keystores

  • Advanced SSL configuration - No hostname verification control, trust strategies, etc.

These limitations prevent deployment in enterprise environments requiring client certificate authentication or existing PKI infrastructure using JKS/PKCS12 formats.

Questions:

  1. Are there plans to enhance SSL/TLS capabilities in future releases?

  2. Is there a roadmap for mTLS support?

2

Thanks for raising these @AnshJ, discussing these internally.

3

Hi @AnshJ, thanks for reaching out.

Can you please clarify how you configure extended SSL options in the v2 client? Am I correct in assuming that you’re using a custom OkHttpBuilder?

Thanks for your response—it will help us better understand your requirements.

Best

4

Hi @bednar @suyash,

Yes, you’re absolutely correct.

The v2 client enables extended SSL options through custom OkHttpClient configuration:

OkHttpClient.Builder httpBuilder = new OkHttpClient.Builder()

.sslSocketFactory(sslContext.getSocketFactory(), 

                  (X509TrustManager) tmf.getTrustManagers()\[0\])

.hostnameVerifier(customHostnameVerifier);

Would it be feasible to add similar support for SSL/TLS in V3 either through HTTP client injection to v3, or extending ClientConfig with enterprise SSL options like:

  • keyStorePath / keyStorePassword

  • keyStoreType (JKS/PKCS12)

  • customTrust Store support

This would enable enterprise adoption without requiring infrastructure changes to accommodate PEM-only workflows.

1 Like
5

Following up @bednar , @suyash
Did you guys checked this? It is required to have SSL enabled for Self hosted databases.

6

Hi @AnshJ can you please open this as issue here, be easier to track and see updates: GitHub · Where software is built Thanks!