apache/cassandra · error · AuthenticationException

Invalid or not supported certificate

Error message

Invalid or not supported certificate

What it means

AuthenticationException from getAuthenticatedUser after the certificate chain was present: certificateValidator.isValidCertificate rejected the chain. The chain is malformed, expired, or otherwise fails the configured validator's checks (the message itself is generic; the validator logs specifics via nospamLogger).

Solutions

1. Inspect server logs for the validator's detailed reason for rejection
2. Renew or reissue the client certificate if it is expired or signed by an untrusted CA
3. Ensure the validator's truststore includes the CA that signed the client certificate and the cert type is supported

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java:215 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/a59ec11fd6e65593. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java:215

        @Override
        public boolean isComplete()
        {
            return true;
        }

        @Override
        public AuthenticatedUser getAuthenticatedUser() throws AuthenticationException
        {
            if (clientCertificateChain == null || clientCertificateChain.length == 0)
            {
                throw new AuthenticationException("No certificate present on connection");
            }

            if (!certificateValidator.isValidCertificate(clientCertificateChain))
            {
                String message = "Invalid or not supported certificate";
                nospamLogger.error(message);
                throw new AuthenticationException(message);
            }

            String identity = certificateValidator.identity(clientCertificateChain);
            if (StringUtils.isEmpty(identity))
            {
                String msg = "Unable to extract client identity from certificate for authentication";
                nospamLogger.error(msg);
                throw new AuthenticationException(msg);
            }
            String role = identityCache.get(identity);
            if (role == null)
            {
                String msg = "Certificate identity '{}' not authorized";
                nospamLogger.error(msg, identity);
                throw new AuthenticationException(MessageFormatter.format(msg, identity).getMessage());
            }

            // Validates that the certificate validity period does not exceed the maximum certificate configured validity period

View on GitHub (pinned to 88fd0f6a0e)