apache/cassandra · error · SSLException

Must provide outbound_keystore or outbound_private_key in…

Error message

Must provide outbound_keystore or outbound_private_key in configuration for PEMBasedSSlContextFactory

What it means

In buildKeyManagerFactory, when no inline PEM key material and no usable keystore is configured for the outbound context, the factory throws SSLException('Must provide outbound_keystore or outbound_private_key in configuration for PEMBasedSSlContextFactory'). Client-to-client (outbound) TLS cannot be built without key material.

Solutions

1. Configure outbound_keystore or outbound_private_key (plus certificate) in the PEM SSL options when outbound encryption is used
2. Disable outbound client encryption if it is not required

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:257 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/59517687f98e4f08. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:257

                if (pemBasedKeyStoreContext.maybeFilebasedKey)
                {
                    pemBasedKeyStoreContext.key = readPEMFile(keyStoreContext.filePath); // read PEM from the file
                }

                KeyManagerFactory kmf = KeyManagerFactory.getInstance(
                algorithm == null ? KeyManagerFactory.getDefaultAlgorithm() : algorithm);
                KeyStore ks = buildKeyStore(pemBasedKeyStoreContext.key, pemBasedKeyStoreContext.password);
                if (!keyStoreContext.checkedExpiry)
                {
                    checkExpiredCerts(ks);
                    keyStoreContext.checkedExpiry = true;
                }
                kmf.init(ks, pemBasedKeyStoreContext.password != null ? pemBasedKeyStoreContext.password.toCharArray() : null);
                return kmf;
            }
            else
            {
                throw new SSLException("Must provide outbound_keystore or outbound_private_key in configuration for PEMBasedSSlContextFactory");
            }
        }
        catch (Exception e)
        {
            throw new SSLException("Failed to build key manager store for secure connections", e);
        }
    }

    /**
     * Builds TrustManagerFactory from the PEM based truststore.
     *
     * @return TrustManagerFactory from the PEM based truststore
     * @throws SSLException if any issues encountered during the build process
     */
    @Override
    protected TrustManagerFactory buildTrustManagerFactory() throws SSLException
    {
        try

View on GitHub (pinned to 88fd0f6a0e)