{"record":{"id":"2ea669ef7f0bad56","repo":"apache/cassandra","slug":"no-identity-was-extracted-from-the-outbound-keysto","errorCode":null,"errorMessage":"No identity was extracted from the outbound keystore '%s'","messagePattern":"No identity was extracted from the outbound keystore '(.+?)'","errorType":"exception","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/MutualTlsInternodeAuthenticator.java","lineNumber":146,"sourceCode":"                String nodeIdentity = parameters.get(NODE_IDENTITY);\n                if (!trustedIdentities.contains(nodeIdentity))\n                {\n                    throw new ConfigurationException(\"Configured node identity is not matching identity extracted\" +\n                                                     \"from the keystore\");\n                }\n                trustedIdentities.retainAll(Collections.singleton(nodeIdentity));\n            }\n        }\n\n        if (!trustedIdentities.isEmpty())\n        {\n            logger.info(\"Initializing internode authenticator with identities {}\", trustedIdentities);\n        }\n        else\n        {\n            String message = String.format(\"No identity was extracted from the outbound keystore '%s'\", config.server_encryption_options.outbound_keystore);\n            logger.info(message);\n            throw new ConfigurationException(message);\n        }\n\n        certificateValidityPeriodValidator = new MutualTlsCertificateValidityPeriodValidator(config.server_encryption_options.max_certificate_validity_period);\n        certificateValidityWarnThreshold = config.server_encryption_options.certificate_validity_warn_threshold;\n    }\n\n    @Override\n    public boolean authenticate(InetAddress remoteAddress, int remotePort)\n    {\n        throw new UnsupportedOperationException(\"mTLS Authenticator only supports certificate based authenticate method\");\n    }\n\n    @Override\n    public boolean authenticate(InetAddress remoteAddress, int remotePort, Certificate[] certificates, InternodeConnectionDirection connectionType)\n    {\n        return authenticateInternodeWithMtls(remoteAddress, remotePort, certificates, connectionType);\n    }\n","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/MutualTlsInternodeAuthenticator.java#L128-L164","documentation":"Thrown as a ConfigurationException when the outbound keystore configured in server_encryption_options either does not exist, is unreadable/malformed, or contains no extractable identity. MutualTlsInternodeAuthenticator requires at least one identity to authenticate outgoing internode connections, so startup fails.","triggerScenarios":"Initializing the authenticator with config.server_encryption_options.outbound_keystore pointing to an empty, missing, corrupt, or password-protected-wrongly keystore from which no identity can be extracted.","commonSituations":"Wrong keystore path in cassandra.yaml; keystore created without any certificate entry; unsupported keystore type/format; permissions preventing the Cassandra process from reading the file.","solutions":["Verify outbound_keystore path exists and is readable by the cassandra user","Inspect the keystore with keytool -list and confirm it contains a private-key/certificate entry","Regenerate the keystore with the node certificate if it is empty or corrupt","Confirm keystore type (PKCS12/JKS) and password match the configuration"],"exampleFix":"// before\nserver_encryption_options:\n  outbound_keystore: /etc/cassandra/empty.p12\n// after\n$ keytool -list -keystore /etc/cassandra/outbound.p12  # confirm entries\nserver_encryption_options:\n  outbound_keystore: /etc/cassandra/outbound.p12","handlingStrategy":"validation","validationCode":"// shell preflight\nif [ ! -r \"$OUTBOUND_KEYSTORE\" ]; then echo \"keystore missing/unreadable\"; exit 1; fi\nkeytool -list -keystore \"$OUTBOUND_KEYSTORE\" -storepass \"$KS_PASS\" | grep -q 'PrivateKeyEntry' || { echo 'no identity entry'; exit 1; }","typeGuard":null,"tryCatchPattern":"try { authenticator.validateConfiguration(); }\ncatch (ConfigurationException e) { LOG.error(\"Outbound keystore has no identity: \" + e.getMessage()); throw e; }","preventionTips":["Preflight keystore existence, readability, and non-emptiness in deployment scripts","Mount keystores with correct ownership for the cassandra user","Validate keystore contents after every certificate rotation"],"tags":["tls","keystore","configuration","internode-authentication"],"backgroundTag":"missing-credentials","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}