{"record":{"id":"1c5bba2b2f169f10","repo":"apache/cassandra","slug":"mtls-authenticator-only-supports-certificate-based","errorCode":null,"errorMessage":"mTLS Authenticator only supports certificate based authenticate method","messagePattern":"mTLS Authenticator only supports certificate based authenticate method","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/MutualTlsInternodeAuthenticator.java","lineNumber":156,"sourceCode":"        if (!trustedIdentities.isEmpty())\n        {\n            logger.info(\"Initializing internode authenticator with identities {}\", trustedIdentities);\n        }\n        else\n        {\n            String message = String.format(\"No identity was extracted from the outbound keystore '%s'\", config.server_encryption_options.outbound_keystore);\n            logger.info(message);\n            throw new ConfigurationException(message);\n        }\n\n        certificateValidityPeriodValidator = new MutualTlsCertificateValidityPeriodValidator(config.server_encryption_options.max_certificate_validity_period);\n        certificateValidityWarnThreshold = config.server_encryption_options.certificate_validity_warn_threshold;\n    }\n\n    @Override\n    public boolean authenticate(InetAddress remoteAddress, int remotePort)\n    {\n        throw new UnsupportedOperationException(\"mTLS Authenticator only supports certificate based authenticate method\");\n    }\n\n    @Override\n    public boolean authenticate(InetAddress remoteAddress, int remotePort, Certificate[] certificates, InternodeConnectionDirection connectionType)\n    {\n        return authenticateInternodeWithMtls(remoteAddress, remotePort, certificates, connectionType);\n    }\n\n\n    @Override\n    public void validateConfiguration() throws ConfigurationException\n    {\n        Config config = DatabaseDescriptor.getRawConfig();\n        if (config.server_encryption_options.internode_encryption == EncryptionOptions.ServerEncryptionOptions.InternodeEncryption.none\n            || config.server_encryption_options.getClientAuth() != REQUIRED)\n        {\n            String msg = \"MutualTlsInternodeAuthenticator requires server_encryption_options.internode_encryption to be enabled\" +\n                         \" & server_encryption_options.require_client_auth to be true\";","sourceCodeStart":138,"sourceCodeEnd":174,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/MutualTlsInternodeAuthenticator.java#L138-L174","documentation":"MutualTlsInternodeAuthenticator only supports the certificate-based authenticate() overload that receives the peer's certificate chain and connection direction. The plain address/port-only authenticate(InetAddress, int) method is intentionally unimplemented and always throws UnsupportedOperationException.","triggerScenarios":"Calling internodeAuthenticator.authenticate(remoteAddress, remotePort) on a MutualTlsInternodeAuthenticator instance, e.g. from custom code or tooling that uses the legacy two-argument API.","commonSituations":"Custom middleware or patched transport code invoking the legacy authenticate signature; third-party integrations written for the plain IInternodeAuthenticator interface.","solutions":["Use the certificate-based overload authenticate(InetAddress, int, Certificate[], InternodeConnectionDirection) instead","Do not call the address-only authenticate method on this authenticator","Switch to the default IInternodeAuthenticator implementation if certificate-based authentication is not desired"],"exampleFix":"// before\nauthenticator.authenticate(remoteAddress, remotePort);\n// after\nauthenticator.authenticate(remoteAddress, remotePort, certificates, connectionType);","handlingStrategy":"type-guard","validationCode":"if (authenticator instanceof MutualTlsInternodeAuthenticator)\n    authenticator.authenticate(addr, port, certs, direction);\nelse\n    authenticator.authenticate(addr, port);","typeGuard":"if (authenticator instanceof MutualTlsInternodeAuthenticator) { /* must use certificate overload */ }","tryCatchPattern":"try { authenticator.authenticate(addr, port); }\ncatch (UnsupportedOperationException e) { /* switch to certificate-based overload */ }","preventionTips":["Only call the two-argument authenticate on non-mTLS authenticators","Prefer the full certificate-based interface when integrating with mTLS auth"],"tags":["unsupported-operation","mtls","api-usage"],"backgroundTag":"unsupported-operation","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}