apache/cassandra · error · IllegalArgumentException

Configuration must specify value for either keystore or…

Error message

Configuration must specify value for either keystore or private_key, not both for PEMBasedSSlContextFactory

What it means

Fires during PEMBasedSslContextFactory initialization when the ssl-options configuration provides both a keystore file and an inline private_key for the inbound identity. The factory supports exactly one private key source per direction, so a mixed configuration is ambiguous and rejected before any keystore is built.

Solutions

1. Remove either the keystore or the private_key entry from cassandra.yaml so only one inbound private key source remains
2. If migrating from file-based to PEM-based config, comment out keystore/keystore_password and keep private_key (or vice versa)

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:358 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/ce38f8476c56b390. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:358

        KeyStore keyStore = KeyStore.getInstance(DEFAULT_TARGET_STORETYPE);
        keyStore.load(null, null);
        for (int i = 0; i < certChainArray.length; i++)
        {
            keyStore.setCertificateEntry("cassandra-ssl-trusted-cert-" + (i + 1), certChainArray[i]);
        }
        return keyStore;
    }

    /**
     * Enforces that the configuration specified a sole source of loading private keys - either {@code keystore} (the
     * actual file must exist) or {@code private_key}, not both.
     */
    private void enforceSinglePrivateKeySource()
    {
        if (keystoreContext.hasKeystore() && !StringUtils.isEmpty(pemEncodedKeyContext.key))
        {
            throw new IllegalArgumentException("Configuration must specify value for either keystore or private_key, " +
                                               "not both for PEMBasedSSlContextFactory");
        }
        if (outboundKeystoreContext.hasKeystore() && !StringUtils.isEmpty(pemEncodedOutboundKeyContext.key))
        {
            throw new IllegalArgumentException("Configuration must specify value for either outbound_keystore or outbound_private_key, " +
                                               "not both for PEMBasedSSlContextFactory");
        }
    }

    /**
     * Enforces that the configuration specified a sole source of loading trusted certificates - either {@code
     * truststore} (actual file must exist) or {@code trusted_certificates}, not both.
     */
    private void enforceSingleTurstedCertificatesSource()
    {
        if (truststoreFileExists() && !StringUtils.isEmpty(pemEncodedTrustCertificates.key))
        {
            throw new IllegalArgumentException("Configuration must specify value for either truststore or " +

View on GitHub (pinned to 88fd0f6a0e)