apache/cassandra · error · UnsupportedOperationException

mTLS Authenticator only supports certificate based authentic

Error message

mTLS Authenticator only supports certificate based authenticate method

What it means

MutualTlsInternodeAuthenticator only supports the certificate-based authenticate() overload that receives the peer's certificate chain and connection direction. The plain address/port-only authenticate(InetAddress, int) method is intentionally unimplemented and always throws UnsupportedOperationException.

Source

Thrown at src/java/org/apache/cassandra/auth/MutualTlsInternodeAuthenticator.java:156

        if (!trustedIdentities.isEmpty())
        {
            logger.info("Initializing internode authenticator with identities {}", trustedIdentities);
        }
        else
        {
            String message = String.format("No identity was extracted from the outbound keystore '%s'", config.server_encryption_options.outbound_keystore);
            logger.info(message);
            throw new ConfigurationException(message);
        }

        certificateValidityPeriodValidator = new MutualTlsCertificateValidityPeriodValidator(config.server_encryption_options.max_certificate_validity_period);
        certificateValidityWarnThreshold = config.server_encryption_options.certificate_validity_warn_threshold;
    }

    @Override
    public boolean authenticate(InetAddress remoteAddress, int remotePort)
    {
        throw new UnsupportedOperationException("mTLS Authenticator only supports certificate based authenticate method");
    }

    @Override
    public boolean authenticate(InetAddress remoteAddress, int remotePort, Certificate[] certificates, InternodeConnectionDirection connectionType)
    {
        return authenticateInternodeWithMtls(remoteAddress, remotePort, certificates, connectionType);
    }


    @Override
    public void validateConfiguration() throws ConfigurationException
    {
        Config config = DatabaseDescriptor.getRawConfig();
        if (config.server_encryption_options.internode_encryption == EncryptionOptions.ServerEncryptionOptions.InternodeEncryption.none
            || config.server_encryption_options.getClientAuth() != REQUIRED)
        {
            String msg = "MutualTlsInternodeAuthenticator requires server_encryption_options.internode_encryption to be enabled" +
                         " & server_encryption_options.require_client_auth to be true";

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Use the certificate-based overload authenticate(InetAddress, int, Certificate[], InternodeConnectionDirection) instead
2. Do not call the address-only authenticate method on this authenticator
3. Switch to the default IInternodeAuthenticator implementation if certificate-based authentication is not desired

Example fix

// before
authenticator.authenticate(remoteAddress, remotePort);
// after
authenticator.authenticate(remoteAddress, remotePort, certificates, connectionType);

if (authenticator instanceof MutualTlsInternodeAuthenticator)
    authenticator.authenticate(addr, port, certs, direction);
else
    authenticator.authenticate(addr, port);

if (authenticator instanceof MutualTlsInternodeAuthenticator) { /* must use certificate overload */ }

try { authenticator.authenticate(addr, port); }
catch (UnsupportedOperationException e) { /* switch to certificate-based overload */ }

When it happens

Trigger: Calling internodeAuthenticator.authenticate(remoteAddress, remotePort) on a MutualTlsInternodeAuthenticator instance, e.g. from custom code or tooling that uses the legacy two-argument API.

Common situations: Custom middleware or patched transport code invoking the legacy authenticate signature; third-party integrations written for the plain IInternodeAuthenticator interface.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Configured node identity is not matching identity extractedf
• MutualTlsInternodeAuthenticator requires server_encryption_o
• MutualTlsWithPasswordFallbackAuthenticator requires client_e
• Unable to extract Spiffe from the certificate
• Chunk cache size cannot be changed.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/1c5bba2b2f169f10. Report an issue: GitHub.