apache/cassandra · error · IOException

key was not found in keystore

Error message

key %s was not found in keystore

What it means

In JKSKeyProvider.getSecretKey, store.getKey returned null after not throwing: the requested alias does not exist in the keystore (remembering JCEKS lowercases aliases). An IOException('key %s was not found in keystore') is thrown because TDE requires the named secret.

Solutions

1. Use the correct key_alias configured in transparent_data_encryption_options
2. Add the missing key/alias to the keystore or point config to an alias that exists

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/security/JKSKeyProvider.java:84 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/b27e2c52de37cb5b. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/security/JKSKeyProvider.java:84

    {
        // there's a lovely behavior with jceks files that all aliases are lower-cased
        if (isJceks)
            keyAlias = toLowerCaseLocalized(keyAlias);

        Key key;
        try
        {
            String password = options.get(PROP_KEY_PW);
            if (password == null || password.isEmpty())
                password = options.get(PROP_KEYSTORE_PW);
            key = store.getKey(keyAlias, password.toCharArray());
        }
        catch (Exception e)
        {
            throw new IOException("unable to load key from keystore");
        }
        if (key == null)
            throw new IOException(String.format("key %s was not found in keystore", keyAlias));
        return key;
    }
}

View on GitHub (pinned to 88fd0f6a0e)