Full chain/private key is not present in the keystore for ce

Error message

Full chain/private key is not present in the keystore for certificate {}

What it means

While loading identities from the node's keystore at startup, MutualTlsInternodeAuthenticator found a keystore alias whose entry has no certificate chain — meaning the alias does not hold a private key entry with a full chain. That alias is skipped (not registered as a local identity), so it cannot be used as an authorized identity for mTLS internode auth.

Source

Thrown at src/java/org/apache/cassandra/auth/MutualTlsInternodeAuthenticator.java:234

    @VisibleForTesting
    List<String> getIdentitiesFromKeyStore(final String outboundKeyStorePath,
                                           final String outboundKeyStorePassword,
                                           final String storeType)
    {
        final List<String> allUsers = new ArrayList<>();
        try (InputStream ksf = Files.newInputStream(Paths.get(outboundKeyStorePath)))
        {
            final KeyStore ks = KeyStore.getInstance(storeType);
            ks.load(ksf, outboundKeyStorePassword.toCharArray());
            Enumeration<String> enumeration = ks.aliases();
            while (enumeration.hasMoreElements())
            {
                String alias = enumeration.nextElement();
                Certificate[] chain = ks.getCertificateChain(alias);
                if (chain == null)
                {
                    logger.warn("Full chain/private key is not present in the keystore for certificate {}", alias);
                    continue;
                }
                try
                {
                    allUsers.add(certificateValidator.identity(chain));
                }
                catch (AuthenticationException e)
                {
                    // When identity cannot be extracted, this exception is thrown
                    // Ignore it, since only few certificates might contain identity
                }
            }
        }
        catch (Exception e)
        {
            logger.error("Failed to get identities from outbound_keystore {}", outboundKeyStorePath, e);
        }
        return allUsers;

View on GitHub (pinned to 88fd0f6a0e)

Solutions

Remove trusted-certificate-only aliases from the keystore (keytool -delete -alias <alias>) or move them to the truststore.
Ensure each required alias is a PrivateKeyEntry with a complete chain: keytool -list -v -keystore <ks> should show 'PrivateKeyEntry' with chain length > 1 where needed.
Rebuild the keystore with a full chain: openssl pkcs12 -export -in cert.pem -inkey key.pem -certfile chain.pem -out node.p12 and import with keytool -importkeystore.
Verify the identity appears in the authenticator's loaded identities; restart after fixing the keystore.

Example fix

// before (bash): peer cert imported into keystore
keytool -importcert -alias peer1 -file peer1.crt -keystore keystore.p12
// after: delete trusted entry from keystore, put it in truststore
keytool -delete -alias peer1 -keystore keystore.p12
keytool -importcert -alias peer1 -file peer1.crt -keystore truststore.p12

Defensive patterns

Strategy: validation

Validate before calling

// Validate keystore entries before deploying (bash)
keytool -list -v -keystore keystore.p12 -storepass "$KS_PASS" | \
  grep -E 'Alias name|Entry type' # every used alias must be PrivateKeyEntry with a chain

Prevention

Keep peer/trusted certificates in the truststore, never the keystore.
Always import keys with their full chain (PKCS12 export including -certfile chain.pem).
Run keytool -list -v as a deployment pre-check for every keystore change.
Verify loaded identities after startup in the logs.

When it happens

Trigger: KeyStore.aliases() enumeration returns an alias for which ks.getCertificateChain(alias) returns null — e.g. a trusted-cert entry (imported peer cert) or an alias containing only a public key rather than a PrivateKeyEntry.

Common situations: Keystore built with `keytool -importcert` (adds trusted entries) instead of -genkeypair/-importkeystore; merging peer certs into the server keystore; key imported without its chain; corrupted or partially converted PKCS12 files.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/ea18771cd7baffd0. Report an issue: GitHub.