apache/cassandra · error · IllegalArgumentException

Configuration must specify value for either truststore or…

Error message

Configuration must specify value for either truststore or trusted_certificates, not both for PEMBasedSSlContextFactory

What it means

Fires during PEMBasedSslContextFactory initialization when both a truststore file and inline trusted_certificates are configured. The factory accepts only one source of trusted certificates, so the mixed setup is rejected before building the trust manager.

Solutions

1. Keep either truststore (with truststore_password) or trusted_certificates, not both
2. If using PEM certificates inline, remove the truststore path entries from the ssl context options

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:376 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/f0f86d706346e17b. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:376

            throw new IllegalArgumentException("Configuration must specify value for either keystore or private_key, " +
                                               "not both for PEMBasedSSlContextFactory");
        }
        if (outboundKeystoreContext.hasKeystore() && !StringUtils.isEmpty(pemEncodedOutboundKeyContext.key))
        {
            throw new IllegalArgumentException("Configuration must specify value for either outbound_keystore or outbound_private_key, " +
                                               "not both for PEMBasedSSlContextFactory");
        }
    }

    /**
     * Enforces that the configuration specified a sole source of loading trusted certificates - either {@code
     * truststore} (actual file must exist) or {@code trusted_certificates}, not both.
     */
    private void enforceSingleTurstedCertificatesSource()
    {
        if (truststoreFileExists() && !StringUtils.isEmpty(pemEncodedTrustCertificates.key))
        {
            throw new IllegalArgumentException("Configuration must specify value for either truststore or " +
                                               "trusted_certificates, not both for PEMBasedSSlContextFactory");
        }
    }

    public static class PEMBasedKeyStoreContext
    {
        public String key;
        public final String password;
        public final boolean maybeFilebasedKey;
        public final FileBasedStoreContext filebasedKeystoreContext;

        public PEMBasedKeyStoreContext(final String encodedKey, final String getEncodedKeyPassword,
                                       final boolean maybeFilebasedKey, final FileBasedStoreContext filebasedKeystoreContext)
        {
            this.key = encodedKey;
            this.password = getEncodedKeyPassword;
            this.maybeFilebasedKey = maybeFilebasedKey;
            this.filebasedKeystoreContext = filebasedKeystoreContext;

View on GitHub (pinned to 88fd0f6a0e)