was already installed on position . Check the configuration…

Error message

{} was already installed on position {}. Check the configuration of JRE and either remove the provider from java.security or do not install this provider by Cassandra.

What it means

AbstractCryptoProvider.install checks whether the target JCE security provider is already registered at the configured position. When it is and failOnMissingProvider is false, it logs this warning and skips installation; with failOnMissingProvider=true it throws IllegalStateException. It exists to prevent double-registering providers that the JDK already ships.

Solutions

Remove the provider entry from the JDK's java.security file, or remove the Cassandra crypto_provider config so only one installs it.
Verify with a startup check (Security.getProviders()) which position the provider occupies and adjust provider_position.
If deliberate duplication is intended, accept the warning; it is harmless because the provider is already usable.

Example fix

// before (cassandra.yaml)
crypto_provider:
  - class_name: org.apache.cassandra.security.DefaultCryptoProvider
// after: remove the stanza if the JRE already installs the provider
# crypto_provider removed

Defensive patterns

Strategy: validation

Validate before calling

// check if provider already installed before configuring
boolean present = java.util.Arrays.stream(java.security.Security.getProviders())
    .anyMatch(p -> p.getName().equals("AmazonCorrettoCryptoProvider"));
if (present) System.out.println("Remove crypto_provider from cassandra.yaml");

Prevention

Audit the JDK's java.security file for pre-installed providers before adding crypto_provider config.
After JDK upgrades, re-check provider presence - newer JREs bundle common providers.
Keep cassandra.yaml crypto_provider entries minimal and intentional.

When it happens

Trigger: Calling install() (directly or via EncryptedKey/SSLFactory crypto provider config) when a provider with the same name (e.g. default OpenSSL provider) is already present at the requested position in Security.getProviders(), typically because java.security already loads it.

Common situations: Upgrading to a JDK that bundles the provider natively; duplicate provider listed in the java.security file; cassandra.yaml crypto provider config pointing at a provider already installed.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

AI-assisted analysis of apache/cassandra@88fd0f6a0e (2026-09-10). Data as JSON: /api/errors/a4eaf9d9688e25a5. Report an issue: GitHub.

Appendix: source

Thrown at src/java/org/apache/cassandra/security/AbstractCryptoProvider.java:124

            }

            FBUtilities.classForNameWithoutInitialization(getProviderClassAsString(), "crypto provider", Provider.class);

            String providerName = getProviderName();
            int providerPosition = getProviderPosition(providerName);
            if (providerPosition > 0)
            {
                if (providerPosition == 1)
                {
                    logger.info("{} was already installed on position {}.", providerName, providerPosition);
                }
                else if (failOnMissingProvider)
                {
                    throw new IllegalStateException(String.format("%s was already installed on position %s.", providerName, providerPosition));
                }
                else
                {
                    logger.warn("{} was already installed on position {}. Check the configuration of " +
                                "JRE and either remove the provider from java.security or do not install this provider " +
                                "by Cassandra.", providerName, providerPosition);
                    return;
                }
            }
            else
            {
                Runnable r = installator();
                if (r == null)
                    throw new IllegalStateException("Installator runnable can not be null!");
                else
                    r.run();
            }

            if (isHealthyInstallation())
                logger.info("{} health check OK.", getProviderName());
            else
                failureMessage = format("%s has not passed the health check. " +

View on GitHub (pinned to 88fd0f6a0e)