{"record":{"id":"0637db72d1601fb2","repo":"apache/cassandra","slug":"legacy-ssl-storage-port-enabled-is-true-enabled","errorCode":null,"errorMessage":"legacy_ssl_storage_port_enabled is true (enabled) with internode encryption disabled (none). Enable encryption or disable the legacy ssl storage port.","messagePattern":"legacy_ssl_storage_port_enabled is true \\(enabled\\) with internode encryption disabled \\(none\\)\\. Enable encryption or disable the legacy ssl storage port\\.","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/config/DatabaseDescriptor.java","lineNumber":1198,"sourceCode":"            case ssd:\n                diskOptimizationStrategy = new SsdDiskOptimizationStrategy(conf.disk_optimization_page_cross_chance);\n                break;\n            case spinning:\n                diskOptimizationStrategy = new SpinningDiskOptimizationStrategy();\n                break;\n        }\n\n        if (conf.compressed_read_ahead_buffer_size.toKibibytes() > 0 && conf.compressed_read_ahead_buffer_size.toKibibytes() < 256)\n            throw new ConfigurationException(\"compressed_read_ahead_buffer_size must be at least 256KiB (set to 0 to disable), but was \" + conf.compressed_read_ahead_buffer_size, false);\n\n        if (conf.server_encryption_options != null)\n        {\n            conf.server_encryption_options.applyConfig();\n\n            if (conf.server_encryption_options.legacy_ssl_storage_port_enabled &&\n                conf.server_encryption_options.tlsEncryptionPolicy() == EncryptionOptions.TlsEncryptionPolicy.UNENCRYPTED)\n            {\n                throw new ConfigurationException(\"legacy_ssl_storage_port_enabled is true (enabled) with internode encryption disabled (none). Enable encryption or disable the legacy ssl storage port.\");\n            }\n        }\n\n        if (conf.internode_max_message_size != null)\n        {\n            long maxMessageSize = conf.internode_max_message_size.toBytes();\n\n            if (maxMessageSize > conf.internode_application_receive_queue_reserve_endpoint_capacity.toBytes())\n                throw new ConfigurationException(\"internode_max_message_size must no exceed internode_application_receive_queue_reserve_endpoint_capacity\", false);\n\n            if (maxMessageSize > conf.internode_application_receive_queue_reserve_global_capacity.toBytes())\n                throw new ConfigurationException(\"internode_max_message_size must no exceed internode_application_receive_queue_reserve_global_capacity\", false);\n\n            if (maxMessageSize > conf.internode_application_send_queue_reserve_endpoint_capacity.toBytes())\n                throw new ConfigurationException(\"internode_max_message_size must no exceed internode_application_send_queue_reserve_endpoint_capacity\", false);\n\n            if (maxMessageSize > conf.internode_application_send_queue_reserve_global_capacity.toBytes())\n                throw new ConfigurationException(\"internode_max_message_size must no exceed internode_application_send_queue_reserve_global_capacity\", false);","sourceCodeStart":1180,"sourceCodeEnd":1216,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/config/DatabaseDescriptor.java#L1180-L1216","documentation":"The legacy SSL storage port option only makes sense when internode encryption is actually enabled. If server_encryption_options marks legacy_ssl_storage_port_enabled=true while tlsEncryptionPolicy() resolves to UNENCRYPTED (encryption set to 'none'), DatabaseDescriptor fails startup with this ConfigurationException telling you to either enable encryption or disable the legacy port.","triggerScenarios":"cassandra.yaml has server_encryption_options with legacy_ssl_storage_port_enabled: true and internode_encryption: none (or an equivalent configuration that yields TlsEncryptionPolicy.UNENCRYPTED, e.g. missing enabled flag), during applySimpleConfig.","commonSituations":"Upgrades from very old clusters that used ssl_storage_port; operators enabling the legacy flag 'for later' but leaving encryption off; comment-removal in yaml that re-enables the flag without setting internode_encryption.","solutions":["Set legacy_ssl_storage_port_enabled: false (or remove the option) if you don't need the legacy port","Or enable encryption by setting internode_encryption (e.g. to dc/rack/all) in server_encryption_options","Ensure the encryption options include valid keystore/truststore settings so the TLS policy is not UNENCRYPTED"],"exampleFix":"# before (cassandra.yaml)\nserver_encryption_options:\n  internode_encryption: none\n  legacy_ssl_storage_port_enabled: true\n# after\nserver_encryption_options:\n  internode_encryption: dc\n  legacy_ssl_storage_port_enabled: false","handlingStrategy":"validation","validationCode":"if (conf.server_encryption_options.legacy_ssl_storage_port_enabled &&\n    conf.server_encryption_options.tlsEncryptionPolicy() == EncryptionOptions.TlsEncryptionPolicy.UNENCRYPTED)\n    throw new IllegalArgumentException(\"Enable internode encryption or disable legacy_ssl_storage_port_enabled\");","typeGuard":null,"tryCatchPattern":"try { DatabaseDescriptor.applyConfig(conf); } catch (ConfigurationException e) { if (e.getMessage().contains(\"legacy_ssl_storage_port_enabled\")) { /* fix encryption options */ } }","preventionTips":["Only enable legacy_ssl_storage_port_enabled during migration with encryption actually on","Verify internode_encryption is not 'none' when setting any SSL port option","Audit server_encryption_options after upgrades that changed TLS defaults"],"tags":["cassandra","tls","configuration"],"backgroundTag":"conflicting-config-options","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}