apache/cassandra · error · IOException

unable to load key from keystore

Error message

unable to load key from keystore

What it means

In JKSKeyProvider.getSecretKey, store.getKey threw (wrong password for the key, or a keystore-level error), and the catch block rethrows as IOException('unable to load key from keystore'). The TDE secret for the requested alias cannot be retrieved, so encrypt/decrypt operations fail.

Solutions

1. Set the correct key_password (or ensure it falls back to keystore_password) in the encryption options
2. Re-add the key to the keystore under the expected alias

When it happens

Trigger: Thrown at src/java/org/apache/cassandra/security/JKSKeyProvider.java:81 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/b8e9cf2ad9de93b3. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/security/JKSKeyProvider.java:81

    }

    public Key getSecretKey(String keyAlias) throws IOException
    {
        // there's a lovely behavior with jceks files that all aliases are lower-cased
        if (isJceks)
            keyAlias = toLowerCaseLocalized(keyAlias);

        Key key;
        try
        {
            String password = options.get(PROP_KEY_PW);
            if (password == null || password.isEmpty())
                password = options.get(PROP_KEYSTORE_PW);
            key = store.getKey(keyAlias, password.toCharArray());
        }
        catch (Exception e)
        {
            throw new IOException("unable to load key from keystore");
        }
        if (key == null)
            throw new IOException(String.format("key %s was not found in keystore", keyAlias));
        return key;
    }
}

View on GitHub (pinned to 88fd0f6a0e)