apache/cassandra · error · ConfigurationException

Failed to initialize crypto provider %s

Error message

Failed to initialize crypto provider %s

What it means

After a crypto provider class name is known, applyCryptoProvider() reflects/loads the class and installs it. Any exception during that installation (class not found, provider init failure, invalid parameters, missing algorithm) is rethrown as a ConfigurationException naming the configured class, unless it is already a ConfigurationException.

Source

Thrown at src/java/org/apache/cassandra/config/DatabaseDescriptor.java:1655

            throw new ConfigurationException("Failed to initialize crypto provider, class_name cannot be null");

        if (conf.crypto_provider.parameters == null)
            conf.crypto_provider.parameters = new HashMap<>();

        Map<String, String> cryptoProviderParameters = new HashMap<>(conf.crypto_provider.parameters);
        cryptoProviderParameters.putIfAbsent(AbstractCryptoProvider.FAIL_ON_MISSING_PROVIDER_KEY, "false");

        try
        {
            cryptoProvider = FBUtilities.newCryptoProvider(conf.crypto_provider.class_name, cryptoProviderParameters);
            cryptoProvider.install();
        }
        catch (Exception e)
        {
            if (e instanceof ConfigurationException)
                throw (ConfigurationException) e;
            else
                throw new ConfigurationException(String.format("Failed to initialize crypto provider %s", conf.crypto_provider.class_name), e);
        }
    }

    public static void applySeedProvider()
    {
        // load the seeds for node contact points
        if (conf.seed_provider == null)
        {
            throw new ConfigurationException("seeds configuration is missing; a minimum of one seed is required.", false);
        }
        try
        {
            Class<? extends SeedProvider> seedProviderClass =
                FBUtilities.classForNameWithoutInitialization(conf.seed_provider.class_name, "seed provider", SeedProvider.class);
            seedProvider = (SeedProvider) seedProviderClass.getConstructor(Map.class).newInstance(conf.seed_provider.parameters);
        }
        // there are about 5 checked exceptions that could be thrown here.
        catch (Exception e)

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Fix crypto_provider.class_name to the exact fully-qualified class and ensure its JAR is on the classpath (lib/) on every node
2. Check the wrapped cause in the log for the real init failure (missing algorithm, HSM connectivity, bad parameters)
3. Align provider parameters in cassandra.yaml with the provider's documented options; set FAIL_ON_MISSING_PROVIDER to false only if fallback is intended
4. Verify provider compatibility with the installed JDK and re-test with a single-node dev cluster

Example fix

// cassandra.yaml before
crypto_provider:
  class_name: com.example.MyCryptoProvider
// after
crypto_provider:
  class_name: org.apache.cassandra.security.DefaultCryptoProvider
  parameters: {}

String cls = System.getProperty("cassandra.crypto_provider_class_name", conf.crypto_provider != null ? conf.crypto_provider.class_name : null);
if (cls != null) Class.forName(cls); // fail fast if provider JAR missing

try { DatabaseDescriptor.applyCryptoProvider(); } catch (ConfigurationException e) {
    logger.error("Crypto provider {} failed to initialize: {}", e.getCause());
}

When it happens

Trigger: applyCryptoProvider() is called and the configured crypto_provider class fails to load or initialize: wrong class_name, provider JAR absent from the classpath, incompatible provider with the JVM/JDK, or bad parameters map (e.g. fail-on-missing-provider behavior).

Common situations: Third-party JCE provider (e.g. BouncyCastle, AWS CloudHSM PKCS11) JAR not shipped to the node; typo in fully-qualified class name; JDK upgrade changes available algorithms; provider requires an HSM that is unreachable.

Related errors

• Failed to initialize crypto provider, class_name cannot be n
• Could not create Compression for type
• category %s not found in %s
• GRANT operation is not supported by AllowAllAuthorizer
• REVOKE operation is not supported by AllowAllAuthorizer

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/41f4dbaec161670e. Report an issue: GitHub.