apache/cassandra · error · SSLException

Failed to build trust manager store for secure connections

Error message

Failed to build trust manager store for secure connections

What it means

In buildTrustManagerFactory, loading the truststore/PEM certificates or initializing the TrustManagerFactory failed (unreadable file, bad password, unparseable certificates); the failure is wrapped as SSLException('Failed to build trust manager store for secure connections'). TLS trust setup fails at startup.

Solutions

1. Verify the trusted certificate PEM content is valid and parseable
2. Check truststore password/paths and certificate formats (BEGIN/END CERTIFICATE blocks), then restart

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:298 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/8580d55cb9c996b2. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:298

                {
                    pemEncodedTrustCertificates.key = readPEMFile(trustStoreContext.filePath); // read PEM from the file
                }

                TrustManagerFactory tmf = TrustManagerFactory.getInstance(
                algorithm == null ? TrustManagerFactory.getDefaultAlgorithm() : algorithm);
                KeyStore ts = buildTrustStore();
                tmf.init(ts);
                return tmf;
            }
            else
            {
                throw new SSLException("Must provide truststore or trusted_certificates in configuration for " +
                                       "PEMBasedSSlContextFactory");
            }
        }
        catch (Exception e)
        {
            throw new SSLException("Failed to build trust manager store for secure connections", e);
        }
    }

    private String readPEMFile(String file) throws IOException
    {
        return new String(Files.readAllBytes(File.getPath(file)));
    }

    /**
     * Builds KeyStore object given the {@link #DEFAULT_TARGET_STORETYPE} out of the PEM formatted private key material.
     * It uses {@code cassandra-ssl-keystore} as the alias for the created key-entry.
     */
    private static KeyStore buildKeyStore(final String pemEncodedKey, final String keyPassword) throws GeneralSecurityException, IOException
    {
        char[] keyPasswordArray = keyPassword != null ? keyPassword.toCharArray() : null;
        PrivateKey privateKey = PEMReader.extractPrivateKey(pemEncodedKey, keyPassword);
        Certificate[] certChainArray = PEMReader.extractCertificates(pemEncodedKey);
        if (certChainArray == null || certChainArray.length == 0)

View on GitHub (pinned to 88fd0f6a0e)