{"record":{"id":"2fe2dda0b90bb8a4","repo":"apache/cassandra","slug":"failed-to-initialize-crypto-provider-class-name-c","errorCode":null,"errorMessage":"Failed to initialize crypto provider, class_name cannot be null","messagePattern":"Failed to initialize crypto provider, class_name cannot be null","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/config/DatabaseDescriptor.java","lineNumber":1637,"sourceCode":"            throw new ConfigurationException(\"Failed to initialize SSL\", e);\n        }\n    }\n\n    public static void applyCryptoProvider()\n    {\n        if (TEST_SKIP_CRYPTO_PROVIDER_INSTALLATION.getBoolean())\n            return;\n\n        if (conf.crypto_provider == null)\n            conf.crypto_provider = new ParameterizedClass(JREProvider.class.getName(), null);\n\n        // properties beat configuration\n        String classNameFromSystemProperties = CassandraRelevantProperties.CRYPTO_PROVIDER_CLASS_NAME.getString();\n        if (classNameFromSystemProperties != null)\n            conf.crypto_provider.class_name = classNameFromSystemProperties;\n\n        if (conf.crypto_provider.class_name == null)\n            throw new ConfigurationException(\"Failed to initialize crypto provider, class_name cannot be null\");\n\n        if (conf.crypto_provider.parameters == null)\n            conf.crypto_provider.parameters = new HashMap<>();\n\n        Map<String, String> cryptoProviderParameters = new HashMap<>(conf.crypto_provider.parameters);\n        cryptoProviderParameters.putIfAbsent(AbstractCryptoProvider.FAIL_ON_MISSING_PROVIDER_KEY, \"false\");\n\n        try\n        {\n            cryptoProvider = FBUtilities.newCryptoProvider(conf.crypto_provider.class_name, cryptoProviderParameters);\n            cryptoProvider.install();\n        }\n        catch (Exception e)\n        {\n            if (e instanceof ConfigurationException)\n                throw (ConfigurationException) e;\n            else\n                throw new ConfigurationException(String.format(\"Failed to initialize crypto provider %s\", conf.crypto_provider.class_name), e);","sourceCodeStart":1619,"sourceCodeEnd":1655,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/config/DatabaseDescriptor.java#L1619-L1655","documentation":"applyCryptoProvider() installs the pluggable crypto provider used for sensitive-data encryption. Its class_name is taken from system property cassandra.crypto_provider_class_name or the crypto_provider config; if neither is set the required class name is null and a ConfigurationException is thrown because no provider can be instantiated without one.","triggerScenarios":"Calling DatabaseDescriptor.applyCryptoProvider() at startup when transparent/legacy data encryption requires a crypto provider but neither cassandra.crypto_provider_class_name system property nor crypto_provider.class_name in cassandra.yaml is defined.","commonSituations":"Upgrading to a version that mandates an explicit crypto provider while migrating encrypted tables; copying a minimal cassandra.yaml that drops the crypto_provider block; enabling TDE without configuring the provider.","solutions":["Set crypto_provider.class_name in cassandra.yaml (e.g. org.apache.cassandra.security.DefaultCryptoProvider or JCEProvider for your JCE vendor)","Or start the JVM with -Dcassandra.crypto_provider_class_name=<class> (system property beats yaml)","Remove any dependency on encrypted data/crypto features if a provider is genuinely not desired"],"exampleFix":"// cassandra.yaml before\ncrypto_provider:\n  parameters: {}\n// after\ncrypto_provider:\n  class_name: org.apache.cassandra.security.DefaultCryptoProvider\n  parameters: {}","handlingStrategy":"validation","validationCode":"if (conf.crypto_provider == null || conf.crypto_provider.class_name == null\n    && System.getProperty(\"cassandra.crypto_provider_class_name\") == null) {\n    throw new IllegalStateException(\"crypto_provider.class_name must be set (yaml or -Dcassandra.crypto_provider_class_name)\");\n}","typeGuard":null,"tryCatchPattern":"try { DatabaseDescriptor.applyCryptoProvider(); } catch (ConfigurationException e) { /* configure provider, not retryable */ }","preventionTips":["Always ship a crypto_provider block when using data-at-rest encryption features","Remember system property overrides yaml — keep them consistent","Document the provider class in your cluster config runbook"],"tags":["cassandra","configuration","crypto-provider"],"backgroundTag":"missing-required-config-field","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}