apache/cassandra · critical · SSLException

Error creating/initializing the SSL Context

Error message

Error creating/initializing the SSL Context

What it means

AbstractSslContextFactory.createJSSESslContext builds a JSSE SSLContext from the configured keystore/truststore. Any exception while loading key/trust managers or initializing the context is wrapped in a SSLException with this message. It signals the TLS configuration (certificates, keys, passwords, algorithm availability) is unusable.

Source

Thrown at src/java/org/apache/cassandra/security/AbstractSslContextFactory.java:178

    @Override
    public SSLContext createJSSESslContext(EncryptionOptions.ClientEncryptionOptions.ClientAuth clientAuth) throws SSLException
    {
        TrustManager[] trustManagers = null;
        if (clientAuth != NOT_REQUIRED)
            trustManagers = buildTrustManagerFactory().getTrustManagers();

        KeyManagerFactory kmf = buildKeyManagerFactory();

        try
        {
            SSLContext ctx = SSLContext.getInstance("TLS");
            ctx.init(kmf.getKeyManagers(), trustManagers, null);
            return ctx;
        }
        catch (Exception e)
        {
            throw new SSLException("Error creating/initializing the SSL Context", e);
        }
    }

    @Override
    public SslContext createNettySslContext(boolean verifyPeerCertificate, SocketType socketType,
                                            CipherSuiteFilter cipherFilter) throws SSLException
    {
        return createNettySslContext(verifyPeerCertificate ? REQUIRED : NOT_REQUIRED, socketType, cipherFilter);
    }

    @Override
    public SslContext createNettySslContext(EncryptionOptions.ClientEncryptionOptions.ClientAuth clientAuth, SocketType socketType,
                                            CipherSuiteFilter cipherFilter) throws SSLException
    {
        /*
            There is a case where the netty/openssl combo might not support using KeyManagerFactory. Specifically,
            I've seen this with the netty-tcnative dynamic openssl implementation. Using the netty-tcnative
            static-boringssl works fine with KeyManagerFactory. If we want to support all of the netty-tcnative

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Verify the keystore/truststore file paths and passwords in cassandra.yaml (server_encryption_options / client_encryption_options) are correct and the files exist and are readable by the cassandra user.
2. Validate the keystore with `keytool -list -v -keystore <file>` to confirm the password and certificate validity.
3. Check the wrapped cause in the exception chain (getCause) for the concrete failure (NoSuchAlgorithmException, IOException from keystore load, etc.) and fix accordingly.
4. Ensure the JDK supports the configured ciphers/protocol (install JCE unlimited policy on Java 8, or upgrade the JDK).

Example fix

// before (cassandra.yaml)
client_encryption_options:
  enabled: true
  keystore: /wrong/path/.keystore
  keystore_password: wrongpass
// after
client_encryption_options:
  enabled: true
  keystore: /etc/cassandra/.keystore
  keystore_password: cassandra

for (String ks : new String[]{cfg.keystore, cfg.truststore}) {
    File f = new File(ks);
    if (!f.isFile() || !f.canRead()) throw new IllegalStateException("Unreadable keystore: " + ks);
}
try (InputStream in = new FileInputStream(cfg.keystore)) {
    KeyStore.getInstance("JKS").load(in, cfg.keystorePassword.toCharArray()); // throws if password/format wrong
}

try {
    SslContext ctx = factory.createJSSESslContext(true);
} catch (SSLException e) {
    logger.error("SSL init failed; check keystore paths/passwords", e); // inspect e.getCause()
}

When it happens

Trigger: SSLContext.getInstance("TLS") fails (provider missing), or ctx.init() fails because keystore/truststore could not be loaded, wrong password, empty key managers, or invalid key material.

Common situations: Misconfigured cassandra.yaml client/server encryption options: wrong keystore path, wrong keystore/truststore password, expired or corrupt certificate, keytool-generated store of unsupported format, or a JVM lacking the required crypto provider (e.g. missing JCE unlimited strength policy on old JDKs).

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• No ciphers left after filtering supported cipher suite
• PEM based truststore should not be using password. Ignoring
• Dropping unsupported cipher_suite {} from {} configuration
• %s has authorization enabled which requires %s to enable aut
• %s requires %s

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/ad1a720aab170ccc. Report an issue: GitHub.