apache/cassandra · info

Certificate with identity

Error message

Certificate with identity '{}' will expire in {}

What it means

MutualTlsAuthenticator.getAuthenticatedUser validates client certificate chain validity periods; when minutes-to-expiration falls below the configured certificate_validity_warn_threshold it logs a warning via a nospam logger that the certificate for the given identity will expire soon.

Solutions

1. Renew the client certificate identified in the message before it expires (re-issue from your CA and redistribute to the client).
2. Set up automated certificate rotation (cert-manager, Vault PKI) keyed to a threshold well inside the warn window.
3. Tune certificate_validity_warn_threshold in cassandra.yaml to give enough lead time for your rotation process.
4. Monitor the metrics (clientCertificateExpirationDays histogram) and alert on low remaining validity.

Example fix

// before
certificate_validity_warn_threshold: 30d  # too late for manual rotation
// after
certificate_validity_warn_threshold: 30d
# plus automated rotation: cert-manager renewBefore: 45d

# check client cert remaining validity before connecting
from cryptography import x509
not_after = x509.load_pem_x509_certificate(pem).not_valid_after
remaining_days = (not_after - datetime.utcnow()).days
assert remaining_days > 30, "renew client certificate before it expires"

When it happens

Trigger: A mTLS client authenticates with a certificate whose remaining validity (minutesToCertificateExpiration from certificateValidityPeriodValidator) is less than certificate_validity_warn_threshold in cassandra.yaml.

Common situations: Short-lived client certificates approaching expiry; certificates issued by an internal PKI with no automated rotation; clients using long-lived but nearly expired certs after a holiday freeze.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Certificate from : with identity ' ' will expire in
• Configured node identity is not matching identity…
• MutualTlsInternodeAuthenticator requires…
• MutualTlsWithPasswordFallbackAuthenticator requires…
• Unable to extract Spiffe from the certificate

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/c93837aa8dd78f91. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java:240

                nospamLogger.error(msg);
                throw new AuthenticationException(msg);
            }
            String role = identityCache.get(identity);
            if (role == null)
            {
                String msg = "Certificate identity '{}' not authorized";
                nospamLogger.error(msg, identity);
                throw new AuthenticationException(MessageFormatter.format(msg, identity).getMessage());
            }

            // Validates that the certificate validity period does not exceed the maximum certificate configured validity period
            int minutesToCertificateExpiration = certificateValidityPeriodValidator.validate(clientCertificateChain);
            int daysToCertificateExpiration = MutualTlsUtil.minutesToDays(minutesToCertificateExpiration);

            if (certificateValidityWarnThreshold != null
                && minutesToCertificateExpiration < certificateValidityWarnThreshold.toMinutes())
            {
                nospamLogger.warn("Certificate with identity '{}' will expire in {}",
                                  identity, MutualTlsUtil.toHumanReadableCertificateExpiration(minutesToCertificateExpiration));
            }

            // Report metrics on client certificate expiration
            MutualTlsMetrics.instance.clientCertificateExpirationDays.update(daysToCertificateExpiration);

            return new AuthenticatedUser(role, MTLS, Map.of(METADATA_IDENTITY_KEY, identity));
        }

        @Override
        public AuthenticationMode getAuthenticationMode()
        {
            return MTLS;
        }
    }

    static class IdentityCache extends AuthCache<String, String>
    {

View on GitHub (pinned to 88fd0f6a0e)