apache/cassandra · error

peer attempted to establish an unencrypted connection…

Error message

peer {} attempted to establish an unencrypted connection (broadcast address {})

What it means

InboundConnectionInitiator.initiate rejected a peer whose handshake initiation was not a valid TLS/SSL record while the socket requires encryption (server_encryption_options). The connection attempt is refused; logged with the peer and its broadcast address to identify misconfigured clients or wrong-port connections.

Solutions

1. Enable TLS on the connecting client/peer, or adjust server_encryption_options (e.g. optional mode) if unencrypted peers are expected.
2. Verify the peer connects on the intended encrypted port.

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/net/InboundConnectionInitiator.java:328 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/fa0f9ef67fcb7169. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/net/InboundConnectionInitiator.java:328

        @Override
        protected void decode(ChannelHandlerContext ctx, ByteBuf in, List<Object> out) throws Exception
        {
            if (initiate == null) initiate(ctx, in);
            else throw new IllegalStateException("Should no longer be on pipeline");
        }

        void initiate(ChannelHandlerContext ctx, ByteBuf in) throws IOException
        {
            initiate = HandshakeProtocol.Initiate.maybeDecode(in);
            if (initiate == null)
                return;

            logger.trace("Received handshake initiation message from peer {}, message = {}", ctx.channel().remoteAddress(), initiate);

            if (isEncryptionRequired(initiate.from) && !isChannelEncrypted(ctx))
            {
                logger.warn("peer {} attempted to establish an unencrypted connection (broadcast address {})",
                            ctx.channel().remoteAddress(), initiate.from);
                failHandshake(ctx);
                return;
            }

            assert initiate.acceptVersions != null;
            if (logger.isTraceEnabled())
                logger.trace("Connection version {} (min {}) from {}", initiate.acceptVersions.max, initiate.acceptVersions.min, initiate.from);

            final AcceptVersions accept;

            if (initiate.type.isStreaming())
                accept = settings.acceptStreaming;
            else
                accept = settings.acceptMessaging;

            int useMessagingVersion = max(accept.min, min(accept.max, initiate.acceptVersions.max));
            ByteBuf flush = new HandshakeProtocol.Accept(useMessagingVersion, accept.max).encode(ctx.alloc());

View on GitHub (pinned to 88fd0f6a0e)