apache/cassandra · error · SSLException

Must provide truststore or trusted_certificates in…

Error message

Must provide truststore or trusted_certificates in configuration for PEMBasedSSlContextFactory

What it means

In buildTrustManagerFactory, when neither a truststore nor inline trusted_certificates is configured, the factory throws SSLException('Must provide truststore or trusted_certificates in configuration for PEMBasedSSlContextFactory'). Without trust anchors, TLS peers cannot be authenticated, so context construction fails.

Solutions

1. Configure truststore or trusted_certificates in the PEM SSL options
2. Point the truststore path to a valid PEM file containing trusted certificates

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:292 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/3aa020899aee522f. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:292

    {
        try
        {
            if (hasTruststore())
            {
                if (pemEncodedTrustCertificates.maybeFilebasedKey)
                {
                    pemEncodedTrustCertificates.key = readPEMFile(trustStoreContext.filePath); // read PEM from the file
                }

                TrustManagerFactory tmf = TrustManagerFactory.getInstance(
                algorithm == null ? TrustManagerFactory.getDefaultAlgorithm() : algorithm);
                KeyStore ts = buildTrustStore();
                tmf.init(ts);
                return tmf;
            }
            else
            {
                throw new SSLException("Must provide truststore or trusted_certificates in configuration for " +
                                       "PEMBasedSSlContextFactory");
            }
        }
        catch (Exception e)
        {
            throw new SSLException("Failed to build trust manager store for secure connections", e);
        }
    }

    private String readPEMFile(String file) throws IOException
    {
        return new String(Files.readAllBytes(File.getPath(file)));
    }

    /**
     * Builds KeyStore object given the {@link #DEFAULT_TARGET_STORETYPE} out of the PEM formatted private key material.
     * It uses {@code cassandra-ssl-keystore} as the alias for the created key-entry.
     */

View on GitHub (pinned to 88fd0f6a0e)