apache/cassandra · error · AuthenticationException

No certificate present on connection

Error message

No certificate present on connection

What it means

AuthenticationException from MutualTlsAuthenticator's getAuthenticatedUser: the connection completed the SASL handshake but the client certificate chain is null or empty, so there is no certificate to validate an identity against. This is a client-side TLS configuration problem — the TLS layer accepted the connection without a peer certificate (client-auth not enforced at the socket).

Solutions

1. Configure the client to present its certificate during the TLS handshake
2. Enable/require mutual TLS (require_client_auth) on the server socket so certificate-less connections are rejected earlier
3. Verify the client's keystore contains the certificate and the trust path is intact

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java:208 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/8cc9c8f644a99602. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java:208

        @Override
        public boolean shouldSendAuthenticateMessage()
        {
            return false;
        }

        @Override
        public boolean isComplete()
        {
            return true;
        }

        @Override
        public AuthenticatedUser getAuthenticatedUser() throws AuthenticationException
        {
            if (clientCertificateChain == null || clientCertificateChain.length == 0)
            {
                throw new AuthenticationException("No certificate present on connection");
            }

            if (!certificateValidator.isValidCertificate(clientCertificateChain))
            {
                String message = "Invalid or not supported certificate";
                nospamLogger.error(message);
                throw new AuthenticationException(message);
            }

            String identity = certificateValidator.identity(clientCertificateChain);
            if (StringUtils.isEmpty(identity))
            {
                String msg = "Unable to extract client identity from certificate for authentication";
                nospamLogger.error(msg);
                throw new AuthenticationException(msg);
            }
            String role = identityCache.get(identity);
            if (role == null)

View on GitHub (pinned to 88fd0f6a0e)