apache/cassandra · error · IllegalArgumentException

'%skeystore_password' must be specified

Error message

'%skeystore_password' must be specified

What it means

Fired in FileBasedSslContextFactory.validatePassword when the keystore password (or outbound_keystore_password, depending on the flag) is null in cassandra.yaml. The factory cannot build key/trust managers without it, so it throws IllegalArgumentException during SSL context setup at startup or on config validation.

Solutions

  1. Set keystore_password (or outbound_keystore_password) in cassandra.yaml server_encryption_options/client_encryption_options
  2. Use keystore_password_file to supply the password from a file instead of inline config
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/security/FileBasedSslContextFactory.java:145 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/6dbc17ac74498f7f. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/security/FileBasedSslContextFactory.java:145

            }
            hotReloadableFiles = fileList;
        }
    }

    /**
     * Validates the given keystore password.
     *
     * @param isOutboundKeystore {@code true} for the {@code outbound_keystore_password};{@code false} otherwise
     * @param password           value
     * @throws IllegalArgumentException if the {@code password} is null
     */
    protected void validatePassword(boolean isOutboundKeystore, String password)
    {
        if (password == null)
        {
            String keyName = isOutboundKeystore ? "outbound_" : "";
            final String msg = format("'%skeystore_password' must be specified", keyName);
            throw new IllegalArgumentException(msg);
        }
    }

    /**
     * Builds required KeyManagerFactory from the file based keystore. It also checks for the PrivateKey's certificate's
     * expiry and logs {@code warning} for each expired PrivateKey's certitificate.
     *
     * @return KeyManagerFactory built from the file based keystore.
     * @throws SSLException if any issues encountered during the build process
     * @throws IllegalArgumentException if the validation for the {@code keystore_password} fails
     * @see #validatePassword(boolean, String)
     */
    @Override
    protected KeyManagerFactory buildKeyManagerFactory() throws SSLException
    {
        /*
         * Validation of the password is delayed until this point to allow nullable keystore passwords
         * for other use-cases (CASSANDRA-18124).

View on GitHub (pinned to 88fd0f6a0e)