apache/cassandra · error · ConfigurationException

Configured node identity is not matching identity extractedf

Error message

Configured node identity is not matching identity extractedfrom the keystore

What it means

Thrown as a ConfigurationException during MutualTlsInternodeAuthenticator initialization when the node_identity configured under server_encryption_options.outbound_keystore_path/identity is not present among the identities parsed from the outbound keystore. Cassandra validates the configured identity against the keystore at startup to catch configuration mistakes before any internode traffic is accepted.

Source

Thrown at src/java/org/apache/cassandra/auth/MutualTlsInternodeAuthenticator.java:131

            // If trusted_peer_identities identities is configured in cassandra.yaml trust only those identities
            trustedIdentities = Arrays.stream(parameters.get(TRUSTED_PEER_IDENTITIES).split(","))
                                      .collect(Collectors.toList());
        }
        else
        {
            // Otherwise, trust the identities extracted from outbound keystore which is the identity that the node uses
            // for making outbound connections.
            trustedIdentities = getIdentitiesFromKeyStore(config.server_encryption_options.outbound_keystore,
                                                          config.server_encryption_options.outbound_keystore_password,
                                                          config.server_encryption_options.store_type);
            // optionally, if node_identity is configured in the yaml, validate the identity extracted from outbound
            // keystore to avoid any configuration errors
            if (parameters.containsKey(NODE_IDENTITY))
            {
                String nodeIdentity = parameters.get(NODE_IDENTITY);
                if (!trustedIdentities.contains(nodeIdentity))
                {
                    throw new ConfigurationException("Configured node identity is not matching identity extracted" +
                                                     "from the keystore");
                }
                trustedIdentities.retainAll(Collections.singleton(nodeIdentity));
            }
        }

        if (!trustedIdentities.isEmpty())
        {
            logger.info("Initializing internode authenticator with identities {}", trustedIdentities);
        }
        else
        {
            String message = String.format("No identity was extracted from the outbound keystore '%s'", config.server_encryption_options.outbound_keystore);
            logger.info(message);
            throw new ConfigurationException(message);
        }

        certificateValidityPeriodValidator = new MutualTlsCertificateValidityPeriodValidator(config.server_encryption_options.max_certificate_validity_period);

View on GitHub (pinned to 88fd0f6a0e)

Solutions

Open the keystore and extract the actual identity (CN/SAN) of the outbound certificate
Set node_identity in server_encryption_options to exactly match that extracted identity
Re-run node startup; check the log line 'Initializing internode authenticator with identities' for the accepted values
If the keystore was rotated, regenerate the keystore so it contains the intended identity

Example fix

// before (cassandra.yaml)
server_encryption_options:
  outbound_keystore: /etc/cassandra/outbound.p12
  node_identity: node-old.cluster.example.com
// after
server_encryption_options:
  outbound_keystore: /etc/cassandra/outbound.p12
  node_identity: node1.cluster.example.com

Defensive patterns

Strategy: validation

Validate before calling

// before startup: confirm configured identity exists in keystore
keytool -list -v -keystore /etc/cassandra/outbound.p12 | grep -i 'CN=\|SAN'
# compare output to server_encryption_options.node_identity in cassandra.yaml

Try / catch

// catch during startup wiring
try { authenticator.validateConfiguration(); }
catch (ConfigurationException e) { LOG.error("mTLS identity misconfigured: " + e.getMessage()); throw e; }

Prevention

Generate node_identity from the certificate's CN/SAN programmatically rather than hand-editing yaml
Log keystore identities at startup and diff against configuration
Treat node_identity as part of the certificate rotation checklist

When it happens

Trigger: Config server_encryption_options.outbound_keystore_path with a node_identity (NODE_IDENTITY parameter) whose value does not exactly match any certificate identity (e.g. SAN/CN) extracted from the outbound keystore; typos, whitespace, or stale identity after certificate rotation.

Common situations: Copying cassandra.yaml between clusters; rotating certs and forgetting to update node_identity; mismatched case/format between the yaml value and the certificate's identity field.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/a388a085ec16c0e4. Report an issue: GitHub.