{"record":{"id":"1e29698861df4625","repo":"apache/cassandra","slug":"failed-to-build-key-manager-store-for-secure-conne-1e2969","errorCode":null,"errorMessage":"Failed to build key manager store for secure connections","messagePattern":"Failed to build key manager store for secure connections","errorType":"exception","errorClass":"SSLException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java","lineNumber":262,"sourceCode":"                KeyManagerFactory kmf = KeyManagerFactory.getInstance(\n                algorithm == null ? KeyManagerFactory.getDefaultAlgorithm() : algorithm);\n                KeyStore ks = buildKeyStore(pemBasedKeyStoreContext.key, pemBasedKeyStoreContext.password);\n                if (!keyStoreContext.checkedExpiry)\n                {\n                    checkExpiredCerts(ks);\n                    keyStoreContext.checkedExpiry = true;\n                }\n                kmf.init(ks, pemBasedKeyStoreContext.password != null ? pemBasedKeyStoreContext.password.toCharArray() : null);\n                return kmf;\n            }\n            else\n            {\n                throw new SSLException(\"Must provide outbound_keystore or outbound_private_key in configuration for PEMBasedSSlContextFactory\");\n            }\n        }\n        catch (Exception e)\n        {\n            throw new SSLException(\"Failed to build key manager store for secure connections\", e);\n        }\n    }\n\n    /**\n     * Builds TrustManagerFactory from the PEM based truststore.\n     *\n     * @return TrustManagerFactory from the PEM based truststore\n     * @throws SSLException if any issues encountered during the build process\n     */\n    @Override\n    protected TrustManagerFactory buildTrustManagerFactory() throws SSLException\n    {\n        try\n        {\n            if (hasTruststore())\n            {\n                if (pemEncodedTrustCertificates.maybeFilebasedKey)\n                {","sourceCodeStart":244,"sourceCodeEnd":280,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java#L244-L280","documentation":"In buildKeyManagerFactory, building the KeyStore from PEM material or initializing the KeyManagerFactory failed (bad/undecryptable PEM key, wrong password, cert-chain problem); the exception is wrapped as SSLException('Failed to build key manager store for secure connections'). The node cannot present its TLS identity.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:262 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify PEM key file, private key, and passwords are correct and consistent","Ensure the PEM file contains a readable private key and matching certificate chain, then restart"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}