apache/cassandra · error

failureMessage

Error message

failureMessage

What it means

The failure path of AbstractCryptoProvider.install(): after a failed provider installation (and attempted cleanup), Cassandra throws ConfigurationException with a pre-built failureMessage when failOnMissingProvider is true, or logs it as a warning otherwise. The developer sees this message when the configured crypto provider could not be installed and strict failure mode is enabled.

Solutions

1. Read the chained cause (t) for the real installation failure (missing class, native lib, etc.).
2. Add the provider dependency jar/lib to the classpath or install the native library.
3. Correct the crypto_provider class_name/parameters in cassandra.yaml.
4. Set failOnMissingProvider=false to fall back to the JDK default provider if strict installation is not required.

Example fix

// before
crypto_provider:
  - class_name: org.apache.cassandra.security.AmazonCorrettoCryptoProvider
// after: either install the ACCP jar or switch to default
# crypto_provider removed (falls back to JDK provider)

// pre-flight: confirm provider class is loadable
try { Class.forName("com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"); }
catch (ClassNotFoundException e) { throw new RuntimeException("Add provider jar to classpath"); }

try { cryptoProvider.install(); }
catch (ConfigurationException e) {
    logger.error("crypto provider install failed: {}", e.getMessage(), e.getCause());
    // fall back to JDK default provider or abort startup
}

When it happens

Trigger: install() catches a Throwable t while installing the provider; failOnMissingProvider=true causes 'throw new ConfigurationException(failureMessage, t)', aborting node startup or the calling test.

Common situations: Provider jar not on the classpath; provider native library missing (e.g. OpenSSL lib unavailable); typo'd provider class/name in cassandra.yaml; JRE lacks support for the requested provider.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• was already installed on position . Check the configuration…
• Allowing java.lang.System.* access in UDFs is dangerous and…
• Can not initialize CMS without any seeds
• Can't enable audit log archiving via nodetool unless…
• Can't enable full query log archiving via nodetool unless…

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/a7d0423e6bde8cbd. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/security/AbstractCryptoProvider.java:177

        }

        if (failureMessage != null)
        {
            // To be sure there is not any leftover, proactively remove this provider in case of any failure.
            // This method returns silently if the provider is not installed or if name is null.
            try
            {
                uninstall();
            }
            catch (Throwable throwable)
            {
                logger.warn("Uninstallation of {} failed", getProviderName(), throwable);
            }

            if (failOnMissingProvider)
                throw new ConfigurationException(failureMessage, t);
            else
                logger.warn(failureMessage);
        }
    }

    /**
     * Uninstalls this crypto provider of name {@link #getProviderName()}
     *
     * @see Security#removeProvider(String)
     */
    public void uninstall()
    {
        Security.removeProvider(getProviderName());
    }

    private int getProviderPosition(String providerName)
    {
        Provider[] providers = Security.getProviders();

        for (int i = 0; i < providers.length; i++)

View on GitHub (pinned to 88fd0f6a0e)