{"record":{"id":"1b9f9ec8965d54f6","repo":"apache/cassandra","slug":"failed-to-load-key-provider-for-transparent-data-e","errorCode":null,"errorMessage":"failed to load key provider for transparent data encryption","messagePattern":"failed to load key provider for transparent data encryption","errorType":"exception","errorClass":"ConfigurationException","httpStatus":null,"severity":"critical","filePath":"src/java/org/apache/cassandra/security/EncryptionContext.java","lineNumber":83,"sourceCode":"    {\n        this.tdeOptions = tdeOptions;\n        compressor = LZ4Compressor.create(Collections.<String, String>emptyMap());\n        chunkLength = tdeOptions.chunk_length_kb * 1024;\n        this.iv = iv;\n\n        // always attempt to load the cipher factory, as we could be in the situation where the user has disabled encryption,\n        // but has existing commitlogs and sstables on disk that are still encrypted (and still need to be read)\n        CipherFactory factory = null;\n\n        if (tdeOptions.enabled && init)\n        {\n            try\n            {\n                factory = new CipherFactory(tdeOptions);\n            }\n            catch (Exception e)\n            {\n                throw new ConfigurationException(\"failed to load key provider for transparent data encryption\", e);\n            }\n        }\n\n        cipherFactory = factory;\n    }\n\n    public ICompressor getCompressor()\n    {\n        return compressor;\n    }\n\n    public Cipher getEncryptor() throws IOException\n    {\n        return cipherFactory.getEncryptor(tdeOptions.cipher, tdeOptions.key_alias);\n    }\n\n    public Cipher getDecryptor() throws IOException\n    {","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/EncryptionContext.java#L65-L101","documentation":"EncryptionContext's constructor creates the shared CipherFactory from transparent data encryption options; any exception is wrapped in ConfigurationException with this message. It means TDE is enabled but the key provider could not be constructed, so encrypted reads/writes cannot proceed.","triggerScenarios":"Server startup or EncryptionContext creation when tdeOptions.enabled is true and new CipherFactory(tdeOptions) throws — typically because key_provider.class_name is missing/invalid or its constructor fails.","commonSituations":"Typo in key_provider class name, custom key provider JAR not on classpath, invalid key provider parameters (bad keystore path/password) in cassandra.yaml.","solutions":["Fix transparent_data_encryption_options: verify key_provider.class_name, key_provider keystore path/password, and cipher/key_alias values.","Check the wrapped cause for the precise failure (ClassNotFoundException, constructor exception).","Deploy the custom key provider JAR if one is configured.","If TDE is not intended, set transparent_data_encryption_options.enabled: false."],"exampleFix":"// before\ntransparent_data_encryption_options:\n  enabled: true\n  key_provider:\n    class_name: MissingKeyProvider\n// after\ntransparent_data_encryption_options:\n  enabled: true\n  key_provider:\n    class_name: org.apache.cassandra.security.JKSKeyProvider\n    keystore: conf/.keystore\n    keystore_password: cassandra","handlingStrategy":"validation","validationCode":"if (tdeOptions.enabled) {\n    Class.forName(tdeOptions.key_provider.class_name); // fail fast on missing class\n}\n// or start with TDE disabled and enable after a successful CipherFactory construction test","typeGuard":null,"tryCatchPattern":"try {\n    EncryptionContext ctx = DatabaseDescriptor.getEncryptionContext();\n} catch (ConfigurationException e) {\n    logger.error(\"TDE key provider invalid; fix transparent_data_encryption_options\", e);\n}","preventionTips":["Validate TDE config at config-load time before enabling","Keep a startup smoke test that constructs the key provider","Document required JARs for custom providers"],"tags":["encryption","configuration","startup"],"backgroundTag":"invalid-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}