Setting require_client_auth is incompatible with 'rack' and

Error message

Setting require_client_auth is incompatible with 'rack' and 'dc' internode_encryption values. It is possible for an internode connection to pretend to be in the same rack/dc by spoofing its broadcast address in the handshake and bypass authentication. To ensure that mutual TLS authentication is not bypassed, please set internode_encryption to 'all'. Continuing with insecure configuration.

What it means

With internode_encryption set to dc or rack, client certificate authentication can be bypassed: a node can spoof its broadcast address to claim it shares the same rack/dc and connect without mutual TLS validation. EncryptionOptions.applyConfig() detects require_client_auth combined with dc/rack modes and warns that the configuration is insecure, continuing anyway.

Source

Thrown at src/java/org/apache/cassandra/config/EncryptionOptions.java:950

        public ServerEncryptionOptions applyConfig()
        {
            return applyConfigInternal();
        }

        private ServerEncryptionOptions applyConfigInternal()
        {
            super.applyConfig();

            isEnabled = this.internode_encryption != InternodeEncryption.none;

            if (this.enabled != null && this.enabled && !isEnabled)
            {
                logger.warn("Setting server_encryption_options.enabled has no effect, use internode_encryption");
            }

            if (getClientAuth() != ClientEncryptionOptions.ClientAuth.NOT_REQUIRED && (internode_encryption == InternodeEncryption.rack || internode_encryption == InternodeEncryption.dc))
            {
                logger.warn("Setting require_client_auth is incompatible with 'rack' and 'dc' internode_encryption values."
                            + " It is possible for an internode connection to pretend to be in the same rack/dc by spoofing"
                            + " its broadcast address in the handshake and bypass authentication. To ensure that mutual TLS"
                            + " authentication is not bypassed, please set internode_encryption to 'all'. Continuing with"
                            + " insecure configuration.");
            }

            // regardless of the optional flag, if the internode encryption is set to rack or dc
            // it must be optional so that unencrypted connections within the rack or dc can be established.
            isOptional = super.isOptional || internode_encryption == InternodeEncryption.rack || internode_encryption == InternodeEncryption.dc;

            return this;
        }

        public boolean shouldEncrypt(InetAddressAndPort endpoint)
        {
            // When a node is started for the very first time, it has no way to determine whether the seed nodes
            // it makes its initial connections to are in a local or remote datacenter and/or rack. When the node is
            // in this specific state, Locator will return the constant Location.UNKNOWN for any lookup of a peer's

View on GitHub (pinned to 88fd0f6a0e)

Solutions

Set internode_encryption: all so client certificate authentication cannot be bypassed
If dc/rack-only encryption must stay, accept the documented risk after verifying network-level controls inside the dc/rack
Remove require_client_auth if mutual TLS is not actually intended

Example fix

// before
server_encryption_options:
  internode_encryption: dc
  require_client_auth: true
// after
server_encryption_options:
  internode_encryption: all
  require_client_auth: true

Defensive patterns

Strategy: validation

Validate before calling

Map seo = cfg.serverEncryptionOptions;
String mode = (String) seo.getOrDefault("internode_encryption", "none");
boolean clientAuth = Boolean.TRUE.equals(seo.get("require_client_auth"));
if (clientAuth && ("dc".equals(mode) || "rack".equals(mode)))
    throw new IllegalStateException("require_client_auth is insecure with internode_encryption=" + mode + "; use 'all'");

Prevention

Treat require_client_auth + dc/rack as a forbidden combination in config linting
Use internode_encryption: all wherever mutual TLS is required
Include this check in security audits of cassandra.yaml

When it happens

Trigger: server_encryption_options has require_client_auth: true (or client-auth set to REQUIRE) while internode_encryption is dc or rack; checked whenever encryption options are applied at startup or on live config reload.

Common situations: Operators wanting encryption only across datacenters/racks (common optimization) while also requiring client certs, not realizing dc/rack mode defeats mutual auth; security audits flagging this combination.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/d440303da5a81a4f. Report an issue: GitHub.