{"record":{"id":"18f57484e90d29fc","repo":"apache/cassandra","slug":"unable-to-extract-client-identity-from-certificate","errorCode":null,"errorMessage":"Unable to extract client identity from certificate for authentication","messagePattern":"Unable to extract client identity from certificate for authentication","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java","lineNumber":223,"sourceCode":"        {\n            if (clientCertificateChain == null || clientCertificateChain.length == 0)\n            {\n                throw new AuthenticationException(\"No certificate present on connection\");\n            }\n\n            if (!certificateValidator.isValidCertificate(clientCertificateChain))\n            {\n                String message = \"Invalid or not supported certificate\";\n                nospamLogger.error(message);\n                throw new AuthenticationException(message);\n            }\n\n            String identity = certificateValidator.identity(clientCertificateChain);\n            if (StringUtils.isEmpty(identity))\n            {\n                String msg = \"Unable to extract client identity from certificate for authentication\";\n                nospamLogger.error(msg);\n                throw new AuthenticationException(msg);\n            }\n            String role = identityCache.get(identity);\n            if (role == null)\n            {\n                String msg = \"Certificate identity '{}' not authorized\";\n                nospamLogger.error(msg, identity);\n                throw new AuthenticationException(MessageFormatter.format(msg, identity).getMessage());\n            }\n\n            // Validates that the certificate validity period does not exceed the maximum certificate configured validity period\n            int minutesToCertificateExpiration = certificateValidityPeriodValidator.validate(clientCertificateChain);\n            int daysToCertificateExpiration = MutualTlsUtil.minutesToDays(minutesToCertificateExpiration);\n\n            if (certificateValidityWarnThreshold != null\n                && minutesToCertificateExpiration < certificateValidityWarnThreshold.toMinutes())\n            {\n                nospamLogger.warn(\"Certificate with identity '{}' will expire in {}\",\n                                  identity, MutualTlsUtil.toHumanReadableCertificateExpiration(minutesToCertificateExpiration));","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java#L205-L241","documentation":"AuthenticationException from getAuthenticatedUser: the certificate passed validation but certificateValidator.identity() returned null or empty for the chain — the validator could not extract a usable identity (e.g. no SAN of the expected type, unreadable CN) to map to a Cassandra role.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java:223 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Regenerate the client certificate with a subject/SAN structure the configured validator can parse","Configure the identity extractor (e.g. validator class and its parsing rules) to match the certificate's identity field","Verify the certificate actually contains the identity attribute expected by the validator"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}