apache/cassandra · error · RuntimeException

couldn't load keystore

Error message

couldn't load keystore

What it means

In the JKSKeyProvider constructor, KeyStore.load fails (missing keystore file, wrong password, or corrupt/invalid store) while initializing transparent data encryption, so an IOException('couldn't load keystore') is thrown. TDE cannot proceed without the key material.

Solutions

1. Verify keystore file path, type (JCEKS/JKS), and keystore_password in transparent_data_encryption_options
2. Create the keystore with the expected type and password, then restart the node

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/security/JKSKeyProvider.java:61 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/4ee87c1e582bf220. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/security/JKSKeyProvider.java:61

    static final String PROP_KEY_PW = "key_password";

    private final KeyStore store;
    private final boolean isJceks;
    private final TransparentDataEncryptionOptions options;

    public JKSKeyProvider(TransparentDataEncryptionOptions options)
    {
        this.options = options;
        logger.info("initializing keystore from file {}", options.get(PROP_KEYSTORE));
        try (InputStream inputStream = Files.newInputStream(File.getPath(options.get(PROP_KEYSTORE))))
        {
            store = KeyStore.getInstance(options.get(PROP_KEYSTORE_TYPE));
            store.load(inputStream, options.get(PROP_KEYSTORE_PW).toCharArray());
            isJceks = store.getType().equalsIgnoreCase("jceks");
        }
        catch (Exception e)
        {
            throw new RuntimeException("couldn't load keystore", e);
        }
    }

    public Key getSecretKey(String keyAlias) throws IOException
    {
        // there's a lovely behavior with jceks files that all aliases are lower-cased
        if (isJceks)
            keyAlias = toLowerCaseLocalized(keyAlias);

        Key key;
        try
        {
            String password = options.get(PROP_KEY_PW);
            if (password == null || password.isEmpty())
                password = options.get(PROP_KEYSTORE_PW);
            key = store.getKey(keyAlias, password.toCharArray());
        }
        catch (Exception e)

View on GitHub (pinned to 88fd0f6a0e)