apache/cassandra · error · AuthenticationException

Certificate identity

Error message

Certificate identity '{}' not authorized

What it means

AuthenticationException from getAuthenticatedUser: an identity was successfully extracted from the certificate, but no role in system_auth grants access for it (the identity-to-role lookup/authorization check failed). The identity itself is syntactically fine; it is simply not an authorized identity.

Solutions

1. Create a role matching the certificate identity or map the identity to an existing role
2. Verify the identity spelling/case used in the role mapping matches the extracted identity
3. If a role initializer is configured, check that it auto-creates roles for authorized identities correctly

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java:230 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/3f5e91ad9062b416. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java:230

            {
                String message = "Invalid or not supported certificate";
                nospamLogger.error(message);
                throw new AuthenticationException(message);
            }

            String identity = certificateValidator.identity(clientCertificateChain);
            if (StringUtils.isEmpty(identity))
            {
                String msg = "Unable to extract client identity from certificate for authentication";
                nospamLogger.error(msg);
                throw new AuthenticationException(msg);
            }
            String role = identityCache.get(identity);
            if (role == null)
            {
                String msg = "Certificate identity '{}' not authorized";
                nospamLogger.error(msg, identity);
                throw new AuthenticationException(MessageFormatter.format(msg, identity).getMessage());
            }

            // Validates that the certificate validity period does not exceed the maximum certificate configured validity period
            int minutesToCertificateExpiration = certificateValidityPeriodValidator.validate(clientCertificateChain);
            int daysToCertificateExpiration = MutualTlsUtil.minutesToDays(minutesToCertificateExpiration);

            if (certificateValidityWarnThreshold != null
                && minutesToCertificateExpiration < certificateValidityWarnThreshold.toMinutes())
            {
                nospamLogger.warn("Certificate with identity '{}' will expire in {}",
                                  identity, MutualTlsUtil.toHumanReadableCertificateExpiration(minutesToCertificateExpiration));
            }

            // Report metrics on client certificate expiration
            MutualTlsMetrics.instance.clientCertificateExpirationDays.update(daysToCertificateExpiration);

            return new AuthenticatedUser(role, MTLS, Map.of(METADATA_IDENTITY_KEY, identity));
        }

View on GitHub (pinned to 88fd0f6a0e)