apache/cassandra · error · RuntimeException

Failed to reload SSL certificates. Please check the SSL…

Error message

Failed to reload SSL certificates. Please check the SSL certificates

What it means

Nodetool ReloadSslCertificates calls probe.reloadSslCerts() over JMX to hot-reload the node's SSL keystores/truststores. Any IOException from that remote call is wrapped in this RuntimeException telling the operator to check the certificates.

Solutions

1. Check the wrapped cause and node logs for the underlying SSL error
2. Validate keystore/truststore paths and passwords in cassandra.yaml
3. Ensure certificate files are readable by the cassandra user
4. Fix config and retry `nodetool reloadssl`, or restart the node if reload keeps failing

Example fix

// before
server_encryption_options: keystore: /missing/path/keystore.jks
// after
server_encryption_options: keystore: /etc/cassandra/ssl/keystore.jks

test -r "$KEYSTORE" && openssl x509 -in "$CERT" -noout >/dev/null && echo "cert files OK"

try { probe.reloadSslCerts(); } catch (RuntimeException e) { log.error("reloadssl failed; check keystore paths/passwords: {}", e.getCause(), e); throw e; }

When it happens

Trigger: `nodetool reloadssl` when the JMX call fails: node unreachable, or the node-side reload itself reported an IO error (unreadable/malformed keystore, wrong password file path).

Common situations: Rotating certificates with a typo'd keystore path in cassandra.yaml; keystore password mismatch; stale JMX connection; files replaced with wrong permissions before reload.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Argument must have keyspace and table values.
• Error during clearing snapshots
• Error during moving node
• Error during taking a snapshot
• error

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/9a5d85f25d0af7e7. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/tools/nodetool/ReloadSslCertificates.java:38

import java.io.IOException;

import org.apache.cassandra.tools.NodeProbe;

import picocli.CommandLine.Command;

@Command(name = "reloadssl", description = "Signals Cassandra to reload SSL certificates")
public class ReloadSslCertificates extends AbstractCommand
{
    @Override
    public void execute(NodeProbe probe)
    {
        try
        {
            probe.reloadSslCerts();
        }
        catch (IOException e)
        {
            throw new RuntimeException("Failed to reload SSL certificates. Please check the SSL certificates", e);
        }
    }
}

View on GitHub (pinned to 88fd0f6a0e)