apache/cassandra · warning

Dropping unsupported cipher_suite {} from {} configuration

Error message

Dropping unsupported cipher_suite {} from {} configuration

What it means

SSLFactory.filterCipherSuites filters the configured cipher suite list against the suites the JRE actually supports, dropping unsupported entries with this warning. It prevents IllegalArgumentException later when enabling an unknown TLS cipher, at the cost of silently (well, warningly) weakening the configured cipher list.

Source

Thrown at src/java/org/apache/cassandra/security/SSLFactory.java:341

            else
            {
                newCiphers = new ArrayList<>(supportedCiphers.size());
            }
            for (String c : ciphers)
            {
                if (c == null)
                {
                    break;
                }
                if (supportedCiphers.contains(c))
                {
                    newCiphers.add(c);
                }
                else
                {
                    if (settingDescription != null)
                    {
                        logger.warn("Dropping unsupported cipher_suite {} from {} configuration",
                                    c, toLowerCaseLocalized(settingDescription));
                    }
                }
            }
            if (newCiphers.isEmpty())
            {
                throw new IllegalStateException("No ciphers left after filtering supported cipher suite");
            }

            return newCiphers.toArray(new String[0]);
        }
    }

    private static boolean filterOutSSLv2Hello(String string)
    {
        return !string.equals("SSLv2Hello");
    }

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Check the warning for the exact dropped cipher name and fix typos.
2. List supported ciphers for the JDK and keep only supported ones (e.g. via openssl or a small SSLSocketFactory.getSupportedCipherSuites() dump).
3. Remove obsolete cipher entries from cipher_suites, or install the JCE unlimited policy/JDK that supports them.
4. Ensure the intersection of configured and supported ciphers is non-empty, otherwise the subsequent 'all ciphers dropped' failure fires.

Example fix

// before (cassandra.yaml)
cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA, TLS_AES_128_GCM_SHA256_TYPONAME]
// after
cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA, TLS_AES_128_GCM_SHA256]

// verify each configured cipher is supported by the target JDK
String[] configured = {...}; // from cassandra.yaml
Set<String> supported = Set.of(SSLContext.getDefault().getSupportedSSLParameters().getCipherSuites());
java.util.Arrays.stream(configured)
    .filter(c -> !supported.contains(c))
    .forEach(c -> System.err.println("Unsupported cipher in config: " + c));

When it happens

Trigger: cassandra.yaml cipher_suites contains a cipher the installed JDK does not support (wrong name, deprecated algorithm removed by JCE policy, or TLS1.3-only name used with TLS1.2 config).

Common situations: Migrating configs between JDK vendors/versions (e.g. cipher removed in newer JDK); typo in cipher name like TLS_ECDHE_RSA_WITH_AES_256_GCM; FIPS-restricted JDK dropping ciphers.

Related errors

• Error creating/initializing the SSL Context
• No ciphers left after filtering supported cipher suite
• PEM based truststore should not be using password. Ignoring
• Configured node identity is not matching identity extractedf
• No identity was extracted from the outbound keystore '%s'

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/e8e043153634ebf1. Report an issue: GitHub.