apache/cassandra · error · IOException

failed to load key from cache:

Error message

failed to load key from cache: 

What it means

retrieveKey loads a key alias through a Caffeine cache; if the underlying loader completes exceptionally with a non-IOException (e.g. unchecked exception from the key provider), it is rethrown as IOException("failed to load key from cache: <alias>"). The alias in the message identifies which key failed.

Solutions

1. Inspect the cause chain for the root error (wrong password, corrupt store, missing alias).
2. Verify the keystore password and that key_alias exists in the store.
3. Restore the referenced key version if it was rotated away; TDE segments still need the original key to decrypt.

Example fix

// before: alias rotated out of keystore
keytool -delete -alias old_key -keystore .keystore
// after: keep old keys while encrypted data referencing them exists
keytool -list -v -keystore .keystore  # confirm all aliases in use are retained

try (InputStream in = new FileInputStream(keystorePath)) {
    KeyStore ks = KeyStore.getInstance("JCEKS");
    ks.load(in, password.toCharArray());
    if (!ks.containsAlias(keyAlias)) throw new IllegalStateException("alias missing: " + keyAlias);
}

try {
    Key k = retrieveKey(alias);
} catch (IOException e) {
    if (e.getMessage().startsWith("failed to load key from cache")) {
        // root cause in e.getCause(); likely keystore/password/rotation issue
    }
}

When it happens

Trigger: cache.get(keyAlias) completes exceptionally with a CompletionException whose cause is not an IOException — e.g. KeyStoreException, RuntimeException, or UnrecoverableKeyException from the key provider.

Common situations: Corrupt keystore file, wrong keystore password, key alias removed during rotation while old commit log segments still reference it.

Understand the failure class

Background: "failed to read file", EACCES, ENOENT and "could not read <path>" errors: when a program can't read a file from disk — this error's family across 49 libraries.

Related errors

• a hints file cannot be configured for both compression and…
• accord.cache_size option was set incorrectly to
• Cache schema version + expected + does not match current…
• Cannot find configured row cache provider class
• cannot load cipher

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/2164e4320cf7bece. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/security/CipherFactory.java:151

        }
        catch (NoSuchAlgorithmException | NoSuchPaddingException | InvalidAlgorithmParameterException | InvalidKeyException e)
        {
            logger.error("could not build cipher", e);
            throw new IOException("cannot load cipher", e);
        }
    }

    private Key retrieveKey(String keyAlias) throws IOException
    {
        try
        {
            return cache.get(keyAlias);
        }
        catch (CompletionException e)
        {
            if (e.getCause() instanceof IOException)
                throw (IOException)e.getCause();
            throw new IOException("failed to load key from cache: " + keyAlias, e);
        }
    }

    /**
     * A simple struct to use with the thread local caching of Cipher as we can't get the mode (encrypt/decrypt) nor
     * key_alias (or key!) from the Cipher itself to use for comparisons
     */
    private static class CachedCipher
    {
        public final int mode;
        public final String keyAlias;
        public final Cipher cipher;

        private CachedCipher(int mode, String keyAlias, Cipher cipher)
        {
            this.mode = mode;
            this.keyAlias = keyAlias;
            this.cipher = cipher;

View on GitHub (pinned to 88fd0f6a0e)