apache/cassandra · warning

Setting server_encryption_options.enabled has no effect, use

Error message

Setting server_encryption_options.enabled has no effect, use internode_encryption

What it means

In modern Cassandra server_encryption_options, whether encryption is on is determined solely by internode_encryption (none/dc/rack/all); the nested enabled flag is ignored. If a user sets enabled: true while internode_encryption is none, EncryptionOptions.applyConfig() logs this warning so the operator knows encryption is NOT active despite the flag.

Source

Thrown at src/java/org/apache/cassandra/config/EncryptionOptions.java:945

            putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.OUTBOUND_KEYSTORE_PASSWORD, this.outbound_keystore_password);
            putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.OUTBOUND_KEYSTORE_PASSWORD_FILE, this.outbound_keystore_password_file);
        }

        @Override
        public ServerEncryptionOptions applyConfig()
        {
            return applyConfigInternal();
        }

        private ServerEncryptionOptions applyConfigInternal()
        {
            super.applyConfig();

            isEnabled = this.internode_encryption != InternodeEncryption.none;

            if (this.enabled != null && this.enabled && !isEnabled)
            {
                logger.warn("Setting server_encryption_options.enabled has no effect, use internode_encryption");
            }

            if (getClientAuth() != ClientEncryptionOptions.ClientAuth.NOT_REQUIRED && (internode_encryption == InternodeEncryption.rack || internode_encryption == InternodeEncryption.dc))
            {
                logger.warn("Setting require_client_auth is incompatible with 'rack' and 'dc' internode_encryption values."
                            + " It is possible for an internode connection to pretend to be in the same rack/dc by spoofing"
                            + " its broadcast address in the handshake and bypass authentication. To ensure that mutual TLS"
                            + " authentication is not bypassed, please set internode_encryption to 'all'. Continuing with"
                            + " insecure configuration.");
            }

            // regardless of the optional flag, if the internode encryption is set to rack or dc
            // it must be optional so that unencrypted connections within the rack or dc can be established.
            isOptional = super.isOptional || internode_encryption == InternodeEncryption.rack || internode_encryption == InternodeEncryption.dc;

            return this;
        }

View on GitHub (pinned to 88fd0f6a0e)

Solutions

1. Set internode_encryption: all (or dc/rack) in server_encryption_options to actually enable encryption
2. Remove the obsolete enabled key from server_encryption_options to avoid confusion
3. Restart or reload config and verify with nodetool gossipinfo / logs that internode TLS is active

Example fix

// before
server_encryption_options:
  enabled: true
  internode_encryption: none
// after
server_encryption_options:
  internode_encryption: all

Map seo = cfg.serverEncryptionOptions;
if (Boolean.TRUE.equals(seo.get("enabled")) && "none".equals(seo.getOrDefault("internode_encryption", "none")))
    throw new IllegalStateException("server_encryption_options.enabled is ignored; set internode_encryption");

When it happens

Trigger: server_encryption_options in cassandra.yaml contains enabled: true while internode_encryption is none (or absent); also thrown on runtime config updates reloading the yaml. Setting enabled: false or leaving internode_encryption != none does not warn.

Common situations: Migrating older configs where enabled existed; operators assuming enabled: true turns on internode TLS after a version change; automated config generation that emits both keys.

Understand the failure class

Background: "is deprecated and will be removed" — deprecation warnings for old API names, keywords, and options, and how to migrate before the removal release — this error's family across 29 libraries.

Related errors

• legacy_ssl_storage_port_enabled is true (enabled) with inter
• Unrecognized TLS encryption policy:
• Load CIDR groups cache operation not supported by %s
• Unsupported parameter '%s' for %s, supported parameters are
• Configured node identity is not matching identity extractedf

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/b79bc9666f3f7838. Report an issue: GitHub.