{"record":{"id":"2da4ea677d1e39b2","repo":"apache/cassandra","slug":"unrecognized-tls-encryption-policy","errorCode":null,"errorMessage":"Unrecognized TLS encryption policy: ","messagePattern":"Unrecognized TLS encryption policy: ","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"critical","filePath":"src/java/org/apache/cassandra/transport/PipelineConfigurator.java","lineNumber":248,"sourceCode":"                                // Connection use no TLS/SSL encryption, just remove the detection handler and continue without\n                                // SslHandler in the pipeline.\n                                channelHandlerContext.pipeline().remove(SSL_HANDLER);\n                            }\n                        }\n                    });\n                };\n            case ENCRYPTED:\n                logger.debug(\"Enabling encrypted CQL connections between client and server\");\n                return channel -> {\n                    SslContext sslContext = SSLFactory.getOrCreateSslContext(encryptionOptions,\n                                                                             encryptionOptions.getClientAuth(),\n                                                                             ISslContextFactory.SocketType.SERVER,\n                                                                             SSL_FACTORY_CONTEXT_DESCRIPTION);\n                    InetSocketAddress peer = encryptionOptions.require_endpoint_verification ? (InetSocketAddress) channel.remoteAddress() : null;\n                    channel.pipeline().addFirst(SSL_HANDLER, newSslHandler(channel, sslContext, peer));\n                };\n            default:\n                throw new IllegalStateException(\"Unrecognized TLS encryption policy: \" + this.tlsEncryptionPolicy);\n        }\n    }\n\n    public void configureInitialPipeline(Channel channel, Connection.Factory connectionFactory)\n    {\n        ChannelPipeline pipeline = channel.pipeline();\n\n        // Add the ConnectionLimitHandler to the pipeline if configured to do so.\n        if (DatabaseDescriptor.getNativeTransportMaxConcurrentConnections() > 0\n            || DatabaseDescriptor.getNativeTransportMaxConcurrentConnectionsPerIp() > 0)\n        {\n            // Add as first to the pipeline so the limit is enforced as first action.\n            pipeline.addFirst(CONNECTION_LIMIT_HANDLER, connectionLimitHandler);\n        }\n\n        long idleTimeout = DatabaseDescriptor.nativeTransportIdleTimeout();\n        if (idleTimeout > 0)\n        {","sourceCodeStart":230,"sourceCodeEnd":266,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/transport/PipelineConfigurator.java#L230-L266","documentation":"IllegalStateException thrown during pipeline configuration when the configured client/server encryption option string does not match any recognized TLS encryption policy value. Cassandra only accepts a fixed set of encryption settings; anything else means the operator misspelled or supplied an unsupported value in cassandra.yaml, so startup/configuration is aborted. Unlike ProtocolException, this signals a server configuration problem, not a client protocol issue.","triggerScenarios":"encryption_options in cassandra.yaml (or the programmatic equivalent passed to PipelineConfigurator.encryptionConfig) contains a value other than the recognized options (e.g. true/false/unrecognized string) — commonly a typo such as 'enable' or an option name from an older version.","commonSituations":"Upgrading Cassandra and carrying over deprecated encryption option names, typos in cassandra.yaml, copy-pasted configs from other databases, or templating systems injecting wrong values.","solutions":["Correct the encryption option value in cassandra.yaml to a supported setting (e.g. valid ssl_storage_port/client encryption options such as enabled: true/false).","Compare against the documented encryption_options for your Cassandra version; remove deprecated keys.","Validate cassandra.yaml with config-validation enabled before restart.","Check change history of the config file for recently edited encryption blocks."],"exampleFix":"# before\ncassandra.yaml:\n  client_encryption_options:\n    enable: true\n# after\n  client_encryption_options:\n    enabled: true","handlingStrategy":"validation","validationCode":"# validate encryption config before restart\ngrep -E '^\\s*(enabled|require_client_auth)\\s*:' cassandra.yaml  # only recognized keys/values allowed","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate cassandra.yaml after every upgrade (enable config validation)","Diff encryption options against the current version's documentation","Keep encryption settings in source-controlled, reviewed templates"],"tags":["cassandra","tls","configuration"],"backgroundTag":"unsupported-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}