apache/cassandra · error · RuntimeException

Error finding supported TLS Protocols

Error message

Error finding supported TLS Protocols

What it means

tlsInstanceProtocolSubstitution builds a default JVM 'TLS' SSLContext and reads its default SSLParameters to enumerate the supported TLS protocol names (used to emulate the pre-CASSANDRA-13325 'TLS' wildcard). If obtaining the SSLContext, initializing it, or reading its parameters throws — typically a JSSE provider/config problem — it is rethrown as this RuntimeException.

Solutions

1. Inspect the wrapped cause exception (RuntimeException's cause) — it names the actual provider/keystore problem
2. Check the JVM's java.security file has not removed the SunJSSE provider or disabled the TLS algorithms (jdk.tls.disabledAlgorithms)
3. Verify javax.net.ssl.keyStore / trustStore system properties point to valid, password-correct keystores if set
4. Run on a full JDK/JRE with JSSE available rather than a stripped runtime; ensure the JVM security policy permits TLS
5. If in a FIPS environment, confirm the FIPS provider is correctly configured and provides a 'TLS' SSLContext

Example fix

// before: stripped JRE / removed provider breaks default TLS context
SSLContext ctx = SSLContext.getInstance("TLS"); // NoSuchAlgorithmException
// after: run on a full JDK with SunJSSE, or specify an explicitly available provider/protocol set
SSLContext ctx = SSLContext.getInstance("TLSv1.2", "SunJSSE");

List<String> protocols;
try {
    protocols = SSLFactory.tlsInstanceProtocolSubstitution();
} catch (RuntimeException e) {
    logger.error("Could not enumerate default TLS protocols from the JSSE provider; check java.security config and keystore system properties", e);
    protocols = Arrays.asList("TLSv1.2", "TLSv1.3"); // sane fallback
}

When it happens

Trigger: Calling SSLFactory.tlsInstanceProtocolSubstitution() when SSLContext.getInstance("TLS") throws NoSuchProviderException/NoSuchAlgorithmException (no JSSE provider), ctx.init fails (e.g. no default KeyManager/TrustManager can be constructed due to a broken keystore, missing java.security config, or a failing security provider), or params.getProtocols() errors.

Common situations: A JVM with a customized or broken java.security file removing the SunJSSE provider; a misconfigured javax.net.ssl default keystore/truststore system property causing init to throw; running on a stripped JRE lacking the crypto providers; FIPS-mode environments where 'TLS' is not available under that name or provider initialization fails.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Certificate for expired on
• Could not create SSL Context.
• Dropping unsupported cipher_suite
• Error creating/initializing the SSL Context
• Failed to create SSL context using

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/d6c44a8715e7a781. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/security/SSLFactory.java:122

    private static boolean isHotReloadingInitialized = false;

    /** Provides the list of protocols that would have been supported if "TLS" was selected as the
     * protocol before the change for CASSANDRA-13325 that expects explicit protocol versions.
     * @return list of enabled protocol names
     */
    public static List<String> tlsInstanceProtocolSubstitution()
    {
        try
        {
            SSLContext ctx = SSLContext.getInstance("TLS");
            ctx.init(null, null, null);
            SSLParameters params = ctx.getDefaultSSLParameters();
            String[] protocols = params.getProtocols();
            return Arrays.asList(protocols);
        }
        catch (Exception e)
        {
            throw new RuntimeException("Error finding supported TLS Protocols", e);
        }
    }

    /**
     * Create a JSSE {@link SSLContext}.
     */
    public static SSLContext createSSLContext(EncryptionOptions options, EncryptionOptions.ClientEncryptionOptions.ClientAuth clientAuth) throws IOException
    {
        return options.sslContextFactoryInstance.createJSSESslContext(clientAuth);
    }

    /**
     * get a netty {@link SslContext} instance
     */
    public static SslContext getOrCreateSslContext(EncryptionOptions options, EncryptionOptions.ClientEncryptionOptions.ClientAuth clientAuth,
                                                   SocketType socketType,
                                                   String contextDescription) throws IOException
    {

View on GitHub (pinned to 88fd0f6a0e)