apache/cassandra · error · java.lang.IllegalArgumentException

SslContextFactory should configure ' ' as…

Error message

SslContextFactory %s should configure '%s' as encryption_options instead of parameterized keys

What it means

When an ssl_context_factory declares a 'parameters' map, its keys must not duplicate settings that belong to encryption_options. If a parameter key matches a known config key (case-insensitively), prepareSslContextFactoryParameterizedKeys throws IllegalArgumentException telling you to move it into encryption_options.

Solutions

1. Move the offending key/value out of parameters into the encryption_options section (or as factory-specific constructor args)
2. Rename the parameter if it is factory-specific and not a standard encryption option
3. Check the error message for the exact key name flagged

Example fix

// before
ssl_context_factory:
  parameters:
    require_client_auth: true
// after
server_encryption_options:
  require_client_auth: true

// Before deploy, diff ssl_context_factory.parameters keys against encryption_options keys
for (String key : factoryParameters.keySet()) {
    if (ENCRYPTION_OPTION_KEYS.contains(key.toLowerCase(Locale.ROOT)))
        throw new IllegalArgumentException("Move '" + key + "' to encryption_options");
}

try {
    DatabaseDescriptor.applySslContextFactory(...);
} catch (IllegalArgumentException e) {
    logger.error("SSL factory parameter misplacement: {}", e.getMessage());
}

When it happens

Trigger: cassandra.yaml with server_encryption_options.ssl_context_factory.parameters containing keys like 'protocol', 'cipher_suites', 'require_client_auth', etc., which overlap encryption_options fields.

Common situations: Migrating from old-style encryption options into a custom SslContextFactory and leaving standard encryption keys inside parameters; copy-pasted factory configs carrying encryption keys.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Dropping unsupported cipher_suite
• Error creating/initializing the SSL Context
• Failed to initialize SSL
• No ciphers left after filtering supported cipher suite
• PEM based truststore should not be using password. Ignoring…

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/334aa16de7393961. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/config/EncryptionOptions.java:295

    }

    /**
     * Prepares the parameterized keys provided in the configuration for {@link ISslContextFactory} to be passed in
     * as the constructor for its implementation.
     *
     * @throws IllegalArgumentException in case any pre-defined key, as per {@link ConfigKey}, for the encryption
     *                                  options is duplicated in the parameterized keys.
     */
    private void prepareSslContextFactoryParameterizedKeys(Map<String, Object> sslContextFactoryParameters)
    {
        if (ssl_context_factory.parameters != null)
        {
            Set<String> configKeys = ConfigKey.asSet();
            for (Map.Entry<String, String> entry : ssl_context_factory.parameters.entrySet())
            {
                if (configKeys.contains(toLowerCaseLocalized(entry.getKey())))
                {
                    throw new IllegalArgumentException("SslContextFactory " + ssl_context_factory.class_name + " should " +
                                                       "configure '" + entry.getKey() + "' as encryption_options instead of" +
                                                       " parameterized keys");
                }
                sslContextFactoryParameters.put(entry.getKey(), entry.getValue());
            }
        }
    }

    protected void fillSslContextParams(Map<String, Object> sslContextFactoryParameters)
    {
        /*
         * Copy all configs to the Map to pass it on to the ISslContextFactory's implementation
         */
        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.KEYSTORE, this.keystore);
        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.KEYSTORE_PASSWORD, this.keystore_password);
        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.KEYSTORE_PASSWORD_FILE, this.keystore_password_file);
        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.TRUSTSTORE, this.truststore);
        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.TRUSTSTORE_PASSWORD, this.truststore_password);

View on GitHub (pinned to 88fd0f6a0e)