{"record":{"id":"26dec4dd88a3d27f","repo":"apache/cassandra","slug":"dynamic-failuremessage-from-provider-installation","errorCode":null,"errorMessage":"(dynamic failureMessage from provider installation/health check)","messagePattern":"\\(dynamic failureMessage from provider installation/health check\\)","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"critical","filePath":"src/java/org/apache/cassandra/security/AbstractCryptoProvider.java","lineNumber":175,"sourceCode":"                                    getProviderClassAsString(), ex.getMessage());\n            t = ex;\n        }\n\n        if (failureMessage != null)\n        {\n            // To be sure there is not any leftover, proactively remove this provider in case of any failure.\n            // This method returns silently if the provider is not installed or if name is null.\n            try\n            {\n                uninstall();\n            }\n            catch (Throwable throwable)\n            {\n                logger.warn(\"Uninstallation of {} failed\", getProviderName(), throwable);\n            }\n\n            if (failOnMissingProvider)\n                throw new ConfigurationException(failureMessage, t);\n            else\n                logger.warn(failureMessage);\n        }\n    }\n\n    /**\n     * Uninstalls this crypto provider of name {@link #getProviderName()}\n     *\n     * @see Security#removeProvider(String)\n     */\n    public void uninstall()\n    {\n        Security.removeProvider(getProviderName());\n    }\n\n    private int getProviderPosition(String providerName)\n    {\n        Provider[] providers = Security.getProviders();","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/AbstractCryptoProvider.java#L157-L193","documentation":"When installing a custom crypto provider fails (e.g. the provider class can't be found/initialized, or a health check such as fetching a KeyGenerator fails), AbstractCryptoProvider wraps the root cause's message in a ConfigurationException if failOnMissingProvider is true; otherwise it only logs a warning. It signals the configured crypto provider is not usable.","triggerScenarios":"Calling AbstractCryptoProvider.install() (directly or via testCryptoProviderInstallation) when provider creation/registration throws a Throwable and the 'fail_on_missing_provider' config option is enabled — e.g. bad crypto_provider configuration in cassandra.yaml or a JCE provider missing from the classpath.","commonSituations":"Configuring crypto_provider in cassandra.yaml with a misspelled class name; missing provider JARs on the classpath (FIPS/HSM providers); JDK upgrades removing a provider; expired/broken key material causing health-check failures.","solutions":["Read the wrapped failureMessage — it carries the underlying cause of the installation failure","Verify crypto_provider.class_name is correct and the provider JAR is on the classpath","Test the provider standalone (Security.addProvider + KeyGenerator.getInstance) with the same JDK","Set fail_on_missing_provider=false only if the default JDK provider fallback is acceptable","Fix the underlying cause (missing JCE policy, HSM connectivity, key config) and restart"],"exampleFix":"// cassandra.yaml before\ncrypto_provider:\n  - class_name: com.example.MissingProvider\n    parameters:\n      - fail_on_missing_provider: true\n// after: use a provider that exists on the classpath\ncrypto_provider:\n  - class_name: com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider\n    parameters:\n      - fail_on_missing_provider: false","handlingStrategy":"try-catch","validationCode":"try { KeyGenerator kg = KeyGenerator.getInstance(algorithm, providerName); } catch (Exception e) { /* provider unavailable — fix config before install */ }","typeGuard":"boolean providerUsable(Provider p) { try { KeyGenerator.getInstance(\"AES\", p); return true; } catch (Exception e) { return false; } }","tryCatchPattern":"try { cryptoProvider.install(); } catch (ConfigurationException e) { logger.error(\"Crypto provider failed to install: {}\", e.getMessage()); throw new StartupFailure(e); }","preventionTips":["Verify provider class name and JAR presence on the classpath at startup","Test provider installation in CI with the same JDK/JCE configuration","Keep fail_on_missing_provider=true in production to fail fast instead of silent fallback","Monitor logs for the warning path when fail_on_missing_provider=false"],"tags":["cassandra","security","crypto","config"],"backgroundTag":"invalid-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}