{"record":{"id":"049aa302a6d24562","repo":"apache/cassandra","slug":"failed-to-build-key-manager-store-for-secure-conne","errorCode":null,"errorMessage":"failed to build key manager store for secure connections","messagePattern":"failed to build key manager store for secure connections","errorType":"exception","errorClass":"SSLException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/FileBasedSslContextFactory.java","lineNumber":226,"sourceCode":"        try (InputStream ksf = Files.newInputStream(File.getPath(context.filePath)))\n        {\n            final String algorithm = this.algorithm == null ? KeyManagerFactory.getDefaultAlgorithm() : this.algorithm;\n            KeyManagerFactory kmf = KeyManagerFactory.getInstance(algorithm);\n            KeyStore ks = KeyStore.getInstance(store_type);\n            final char[] password = context.password.toCharArray();\n            ks.load(ksf, password);\n\n            if (!context.checkedExpiry)\n            {\n                checkExpiredCerts(ks);\n                context.checkedExpiry = true;\n            }\n            kmf.init(ks, password);\n            return kmf;\n        }\n        catch (Exception e)\n        {\n            throw new SSLException(\"failed to build key manager store for secure connections\", e);\n        }\n    }\n\n    protected boolean checkExpiredCerts(KeyStore ks) throws KeyStoreException\n    {\n        boolean hasExpiredCerts = false;\n        final Date now = new Date(Clock.Global.currentTimeMillis());\n        for (Enumeration<String> aliases = ks.aliases(); aliases.hasMoreElements(); )\n        {\n            String alias = aliases.nextElement();\n            if (ks.getCertificate(alias).getType().equals(\"X.509\"))\n            {\n                Date expires = ((X509Certificate) ks.getCertificate(alias)).getNotAfter();\n                if (expires.before(now))\n                {\n                    hasExpiredCerts = true;\n                    logger.warn(\"Certificate for {} expired on {}\", alias, expires);\n                }","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/FileBasedSslContextFactory.java#L208-L244","documentation":"In getKeyManagerFactory (used by buildKeyManagerFactory/buildOutboundKeyManagerFactory), failures loading the keystore or initializing the KeyManagerFactory (wrong password, missing/corrupt file, expired-cert check failure) are converted to SSLException('failed to build key manager store for secure connections'). The node cannot present its own certificate for TLS.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/security/FileBasedSslContextFactory.java:226 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check keystore path, password, and store type in the SSL configuration","Confirm the keystore file is valid and readable and its password matches, then restart"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}