apache/cassandra · error · SSLException

Could not read any certificates for the certChain for the…

Error message

Could not read any certificates for the certChain for the private key

What it means

In buildKeyStore, parsing the PEM-encoded key material yielded no certificates for the private key's chain (missing CERTIFICATE blocks or the key block only). The code throws KeyError/IOException-style failure with 'Could not read any certificates for the certChain for the private key' because a KeyStore key entry requires a certificate chain.

Solutions

1. Ensure the PEM file used as the keystore contains the full certificate chain along with the private key
2. Re-export the key/cert pair including certificates and update the config path

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:318 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/45daabab84a6d160. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:318

    }

    private String readPEMFile(String file) throws IOException
    {
        return new String(Files.readAllBytes(File.getPath(file)));
    }

    /**
     * Builds KeyStore object given the {@link #DEFAULT_TARGET_STORETYPE} out of the PEM formatted private key material.
     * It uses {@code cassandra-ssl-keystore} as the alias for the created key-entry.
     */
    private static KeyStore buildKeyStore(final String pemEncodedKey, final String keyPassword) throws GeneralSecurityException, IOException
    {
        char[] keyPasswordArray = keyPassword != null ? keyPassword.toCharArray() : null;
        PrivateKey privateKey = PEMReader.extractPrivateKey(pemEncodedKey, keyPassword);
        Certificate[] certChainArray = PEMReader.extractCertificates(pemEncodedKey);
        if (certChainArray == null || certChainArray.length == 0)
        {
            throw new SSLException("Could not read any certificates for the certChain for the private key");
        }

        KeyStore keyStore = KeyStore.getInstance(DEFAULT_TARGET_STORETYPE);
        keyStore.load(null, null);
        keyStore.setKeyEntry("cassandra-ssl-keystore", privateKey, keyPasswordArray, certChainArray);
        return keyStore;
    }

    /**
     * Builds KeyStore object given the {@link #DEFAULT_TARGET_STORETYPE} out of the PEM formatted certificates/public-key
     * material.
     * <p>
     * It uses {@code cassandra-ssl-trusted-cert-<numeric-id>} as the alias for the created certificate-entry.
     */
    private KeyStore buildTrustStore() throws GeneralSecurityException, IOException
    {
        Certificate[] certChainArray = PEMReader.extractCertificates(pemEncodedTrustCertificates.key);
        if (certChainArray == null || certChainArray.length == 0)

View on GitHub (pinned to 88fd0f6a0e)