PEM based truststore should not be using password. Ignoring

Error message

PEM based truststore should not be using password. Ignoring the given value in 'truststore_password' configuration.

What it means

PEMBasedSslContextFactory's constructor validates that PEM truststores are passwordless. PEM-encoded trust certificates are public material, so a configured 'truststore_password' is meaningless; the factory logs this warning and ignores the value. It does not fail startup, but indicates a config mistake.

Source

Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:131

    }

    public PEMBasedSslContextFactory(Map<String, Object> parameters)
    {
        super(parameters);
        final String pemEncodedKey = getString(ConfigKey.ENCODED_KEY.getKeyName());
        final String pemEncodedKeyPassword = StringUtils.defaultString(getString(ConfigKey.KEY_PASSWORD.getKeyName()), keystoreContext.password);
        pemEncodedKeyContext = new PEMBasedKeyStoreContext(pemEncodedKey, pemEncodedKeyPassword, StringUtils.isEmpty(pemEncodedKey), keystoreContext);

        final String pemEncodedOutboundKey = StringUtils.defaultString(getString(ConfigKey.OUTBOUND_ENCODED_KEY.getKeyName()), pemEncodedKey);
        final String outboundKeyPassword = StringUtils.defaultString(StringUtils.defaultString(getString(ConfigKey.OUTBOUND_ENCODED_KEY_PASSWORD.getKeyName()),
                                                                                               outboundKeystoreContext.password), pemEncodedKeyPassword);
        pemEncodedOutboundKeyContext = new PEMBasedKeyStoreContext(pemEncodedKey, outboundKeyPassword, StringUtils.isEmpty(pemEncodedOutboundKey), outboundKeystoreContext);

        validatePasswords();

        if (!StringUtils.isEmpty(trustStoreContext.password))
        {
            logger.warn("PEM based truststore should not be using password. Ignoring the given value in " +
                        "'truststore_password' configuration.");
        }

        final String pemEncodedCerts = getString(ConfigKey.ENCODED_CERTIFICATES.getKeyName());
        pemEncodedTrustCertificates = new PEMBasedKeyStoreContext(pemEncodedCerts, null, StringUtils.isEmpty(pemEncodedCerts), trustStoreContext);
        enforceSinglePrivateKeySource();
        enforceSingleTurstedCertificatesSource();
    }

    /**
     * Decides if this factory has a keystore defined - key material specified in files or inline to the configuration.
     *
     * @return {@code true} if there is a keystore defined; {@code false} otherwise
     */
    @Override
    public boolean hasKeystore()
    {
        return pemEncodedKeyContext.maybeFilebasedKey

View on GitHub (pinned to 88fd0f6a0e)

Solutions

Remove the 'truststore_password' entry from the PEM truststore config in cassandra.yaml.
Keep passwords only for the PEM private key (outbound_key_password / key_password).
Restart and confirm the warning disappears.

Example fix

// before (cassandra.yaml)
truststore: conf/truststore.pem
truststore_password: changeit
// after
truststore: conf/truststore.pem
# truststore_password removed (not used for PEM truststores)

Defensive patterns

Strategy: validation

Validate before calling

// validate PEM config before node startup
if (config.clientEncryptionOptions.truststorePassword != null && "pem".equals(config.clientEncryptionOptions.type))
    throw new IllegalArgumentException("truststore_password must be empty for PEM truststores");

Prevention

Use a config linting checklist when migrating JKS->PEM: drop truststore_password, keep key passwords only.
Keep JKS and PEM config templates separate to avoid copy-paste leakage.
Treat this warning as config debt and fix it the first time it appears.

When it happens

Trigger: Constructing PEMBasedSslContextFactory with server/client_encryption_options of type 'pem' where the trustStoreContext.password field is non-empty in cassandra.yaml.

Common situations: Copy-pasting keystore-style config (with password) from JKS setups into a PEM config; migrating from JKS to PEM and leaving truststore_password behind.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/49f2eac519892910. Report an issue: GitHub.