apache/cassandra · error · ConfigurationException

Unable to create instance of ISslContextFactory for

Error message

Unable to create instance of ISslContextFactory for 

What it means

newSslContextFactory reflectively constructs the configured ISslContextFactory implementation from its class name and parameters. All failures, including class-load errors from the nested classForNameWithoutInitialization call, are surfaced as a ConfigurationException naming the class. The underlying load failure is unwrapped and attached as the direct cause.

Solutions

1. Correct the ssl_factory value to a valid fully-qualified class name
2. Deploy the factory implementation jar to lib/ on all nodes and restart
3. Ensure the class implements ISslContextFactory and has a public (Map) constructor
4. Read the chained cause in the exception/log for the actual failure (ClassNotFound vs constructor error)

Example fix

// before (cassandra.yaml)
server_encryption_options:
  ssl_factory: org.apache.cassandra.security.MySslFactory
// after
server_encryption_options:
  ssl_factory: org.apache.cassandra.security.CustomSslContextFactory

String cn = encOptions.get("ssl_factory");
try { Class<?> c = Class.forName(cn, false, FBUtilities.class.getClassLoader());
      if (!ISslContextFactory.class.isAssignableFrom(c)) throw new IllegalArgumentException(cn + " is not an ISslContextFactory"); }
catch (ClassNotFoundException e) { throw new IllegalArgumentException("ssl_factory class not found: " + cn, e); }

boolean isValidSslFactory(String cn) {
    try { return ISslContextFactory.class.isAssignableFrom(Class.forName(cn, false, Thread.currentThread().getContextClassLoader())); }
    catch (Throwable t) { return false; }
}

try {
    sslContextFactory = FBUtilities.newSslContextFactory(className, parameters);
} catch (ConfigurationException e) {
    throw new IllegalStateException("Check ssl_factory config: " + className, e.getCause());
}

When it happens

Trigger: server_encryption_options or client_encryption_options with an ssl_factory class name that is absent on the classpath, not an ISslContextFactory, missing a (Map) constructor, or whose constructor throws during node startup.

Common situations: Custom SSL factory jar not deployed; typo in ssl_factory FQCN; upgrade changed the required constructor signature; factory constructor throws reading keystore paths.

Related errors

• Certificate for expired on
• Could not create memtable factory for class
• Could not create SSL Context.
• Dropping unsupported cipher_suite
• Error creating/initializing the SSL Context

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/4e8cd68e7172c3fa. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/utils/FBUtilities.java:718

    }

    public static ISslContextFactory newSslContextFactory(String className, Map<String,Object> parameters) throws ConfigurationException
    {
        if (!className.contains("."))
            className = "org.apache.cassandra.security." + className;

        try
        {
            Class<? extends ISslContextFactory> sslContextFactoryClass =
                FBUtilities.classForNameWithoutInitialization(className, "ISslContextFactory", ISslContextFactory.class);
            return sslContextFactoryClass.getConstructor(Map.class).newInstance(parameters);
        }
        catch (Exception ex)
        {
            // Surface the underlying load failure (e.g. ClassNotFoundException) as the direct cause rather than the
            // intermediate ConfigurationException that reports it.
            Throwable cause = ex instanceof ConfigurationException && ex.getCause() != null ? ex.getCause() : ex;
            throw new ConfigurationException("Unable to create instance of ISslContextFactory for " + className, cause);
        }
    }

    public static AbstractCryptoProvider newCryptoProvider(String className, Map<String, String> parameters) throws ConfigurationException
    {
        try
        {
            if (!className.contains("."))
                className = "org.apache.cassandra.security." + className;

            Class<? extends AbstractCryptoProvider> cryptoProviderClass =
                FBUtilities.classForNameWithoutInitialization(className, "crypto provider class", AbstractCryptoProvider.class);
            return cryptoProviderClass.getConstructor(Map.class).newInstance(Collections.unmodifiableMap(parameters));
        }
        catch (Exception e)
        {
            // no need to wrap it in another ConfgurationException if FBUtilities.classForName might throw it
            if (e instanceof ConfigurationException)

View on GitHub (pinned to 88fd0f6a0e)