apache/cassandra · error · SSLException

Could not read any certificates from the given PEM

Error message

Could not read any certificates from the given PEM

What it means

In buildTrustStore, no CERTIFICATE sections could be parsed from the supplied PEM content (empty file, wrong format, or non-certificate blocks only). The code fails with 'Could not read any certificates from the given PEM' because at least one trusted certificate is required to build the trust KeyStore.

Solutions

1. Provide a PEM file with valid certificate blocks for the truststore
2. Verify the PEM content includes BEGIN/END CERTIFICATE sections and fix the file or its path

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:338 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/3e446812e645d4a9. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:338

        KeyStore keyStore = KeyStore.getInstance(DEFAULT_TARGET_STORETYPE);
        keyStore.load(null, null);
        keyStore.setKeyEntry("cassandra-ssl-keystore", privateKey, keyPasswordArray, certChainArray);
        return keyStore;
    }

    /**
     * Builds KeyStore object given the {@link #DEFAULT_TARGET_STORETYPE} out of the PEM formatted certificates/public-key
     * material.
     * <p>
     * It uses {@code cassandra-ssl-trusted-cert-<numeric-id>} as the alias for the created certificate-entry.
     */
    private KeyStore buildTrustStore() throws GeneralSecurityException, IOException
    {
        Certificate[] certChainArray = PEMReader.extractCertificates(pemEncodedTrustCertificates.key);
        if (certChainArray == null || certChainArray.length == 0)
        {
            throw new SSLException("Could not read any certificates from the given PEM");
        }

        KeyStore keyStore = KeyStore.getInstance(DEFAULT_TARGET_STORETYPE);
        keyStore.load(null, null);
        for (int i = 0; i < certChainArray.length; i++)
        {
            keyStore.setCertificateEntry("cassandra-ssl-trusted-cert-" + (i + 1), certChainArray[i]);
        }
        return keyStore;
    }

    /**
     * Enforces that the configuration specified a sole source of loading private keys - either {@code keystore} (the
     * actual file must exist) or {@code private_key}, not both.
     */
    private void enforceSinglePrivateKeySource()
    {
        if (keystoreContext.hasKeystore() && !StringUtils.isEmpty(pemEncodedKeyContext.key))

View on GitHub (pinned to 88fd0f6a0e)