apache/cassandra · error · SSLException

failed to build key manager store for secure connections

Error message

failed to build key manager store for secure connections

What it means

In getKeyManagerFactory (used by buildKeyManagerFactory/buildOutboundKeyManagerFactory), failures loading the keystore or initializing the KeyManagerFactory (wrong password, missing/corrupt file, expired-cert check failure) are converted to SSLException('failed to build key manager store for secure connections'). The node cannot present its own certificate for TLS.

Solutions

1. Check keystore path, password, and store type in the SSL configuration
2. Confirm the keystore file is valid and readable and its password matches, then restart

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/security/FileBasedSslContextFactory.java:226 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/049aa302a6d24562. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/security/FileBasedSslContextFactory.java:226

        try (InputStream ksf = Files.newInputStream(File.getPath(context.filePath)))
        {
            final String algorithm = this.algorithm == null ? KeyManagerFactory.getDefaultAlgorithm() : this.algorithm;
            KeyManagerFactory kmf = KeyManagerFactory.getInstance(algorithm);
            KeyStore ks = KeyStore.getInstance(store_type);
            final char[] password = context.password.toCharArray();
            ks.load(ksf, password);

            if (!context.checkedExpiry)
            {
                checkExpiredCerts(ks);
                context.checkedExpiry = true;
            }
            kmf.init(ks, password);
            return kmf;
        }
        catch (Exception e)
        {
            throw new SSLException("failed to build key manager store for secure connections", e);
        }
    }

    protected boolean checkExpiredCerts(KeyStore ks) throws KeyStoreException
    {
        boolean hasExpiredCerts = false;
        final Date now = new Date(Clock.Global.currentTimeMillis());
        for (Enumeration<String> aliases = ks.aliases(); aliases.hasMoreElements(); )
        {
            String alias = aliases.nextElement();
            if (ks.getCertificate(alias).getType().equals("X.509"))
            {
                Date expires = ((X509Certificate) ks.getCertificate(alias)).getNotAfter();
                if (expires.before(now))
                {
                    hasExpiredCerts = true;
                    logger.warn("Certificate for {} expired on {}", alias, expires);
                }

View on GitHub (pinned to 88fd0f6a0e)