apache/cassandra · error · SSLException

failed to build trust manager store for secure connections

Error message

failed to build trust manager store for secure connections

What it means

In buildTrustManagerFactory, any exception while loading the truststore file or initializing the TrustManagerFactory (bad password, missing/corrupt file, wrong store type) is caught and rethrown as SSLException('failed to build trust manager store for secure connections'). It means outbound/inbound TLS cannot establish trusted certificates.

Solutions

1. Verify truststore path, password, and type in the SSL configuration are correct
2. Ensure the truststore file exists, is readable, and contains valid certificates, then restart

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/security/FileBasedSslContextFactory.java:202 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/3af7f9210c0eff3f. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/security/FileBasedSslContextFactory.java:202

     * @throws SSLException if any issues encountered during the build process
     */
    @Override
    protected TrustManagerFactory buildTrustManagerFactory() throws SSLException
    {
        try (InputStream tsf = Files.newInputStream(File.getPath(trustStoreContext.filePath)))
        {
            final String algorithm = this.algorithm == null ? TrustManagerFactory.getDefaultAlgorithm() : this.algorithm;
            TrustManagerFactory tmf = TrustManagerFactory.getInstance(algorithm);
            KeyStore ts = KeyStore.getInstance(store_type);

            final char[] truststorePassword = StringUtils.isEmpty(trustStoreContext.password) ? null : trustStoreContext.password.toCharArray();
            ts.load(tsf, truststorePassword);
            tmf.init(ts);
            return tmf;
        }
        catch (Exception e)
        {
            throw new SSLException("failed to build trust manager store for secure connections", e);
        }
    }

    private KeyManagerFactory getKeyManagerFactory(final FileBasedStoreContext context) throws SSLException
    {
        try (InputStream ksf = Files.newInputStream(File.getPath(context.filePath)))
        {
            final String algorithm = this.algorithm == null ? KeyManagerFactory.getDefaultAlgorithm() : this.algorithm;
            KeyManagerFactory kmf = KeyManagerFactory.getInstance(algorithm);
            KeyStore ks = KeyStore.getInstance(store_type);
            final char[] password = context.password.toCharArray();
            ks.load(ksf, password);

            if (!context.checkedExpiry)
            {
                checkExpiredCerts(ks);
                context.checkedExpiry = true;
            }

View on GitHub (pinned to 88fd0f6a0e)