apache/cassandra · error · AuthenticationException

Unable to extract client identity from certificate for…

Error message

Unable to extract client identity from certificate for authentication

What it means

AuthenticationException from getAuthenticatedUser: the certificate passed validation but certificateValidator.identity() returned null or empty for the chain — the validator could not extract a usable identity (e.g. no SAN of the expected type, unreadable CN) to map to a Cassandra role.

Solutions

1. Regenerate the client certificate with a subject/SAN structure the configured validator can parse
2. Configure the identity extractor (e.g. validator class and its parsing rules) to match the certificate's identity field
3. Verify the certificate actually contains the identity attribute expected by the validator

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java:223 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/18f57484e90d29fc. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java:223

        {
            if (clientCertificateChain == null || clientCertificateChain.length == 0)
            {
                throw new AuthenticationException("No certificate present on connection");
            }

            if (!certificateValidator.isValidCertificate(clientCertificateChain))
            {
                String message = "Invalid or not supported certificate";
                nospamLogger.error(message);
                throw new AuthenticationException(message);
            }

            String identity = certificateValidator.identity(clientCertificateChain);
            if (StringUtils.isEmpty(identity))
            {
                String msg = "Unable to extract client identity from certificate for authentication";
                nospamLogger.error(msg);
                throw new AuthenticationException(msg);
            }
            String role = identityCache.get(identity);
            if (role == null)
            {
                String msg = "Certificate identity '{}' not authorized";
                nospamLogger.error(msg, identity);
                throw new AuthenticationException(MessageFormatter.format(msg, identity).getMessage());
            }

            // Validates that the certificate validity period does not exceed the maximum certificate configured validity period
            int minutesToCertificateExpiration = certificateValidityPeriodValidator.validate(clientCertificateChain);
            int daysToCertificateExpiration = MutualTlsUtil.minutesToDays(minutesToCertificateExpiration);

            if (certificateValidityWarnThreshold != null
                && minutesToCertificateExpiration < certificateValidityWarnThreshold.toMinutes())
            {
                nospamLogger.warn("Certificate with identity '{}' will expire in {}",
                                  identity, MutualTlsUtil.toHumanReadableCertificateExpiration(minutesToCertificateExpiration));

View on GitHub (pinned to 88fd0f6a0e)