{"record":{"id":"334aa16de7393961","repo":"apache/cassandra","slug":"sslcontextfactory-s-should-configure-s-as-encr","errorCode":null,"errorMessage":"SslContextFactory %s should configure '%s' as encryption_options instead of parameterized keys","messagePattern":"SslContextFactory (.+?) should configure '(.+?)' as encryption_options instead of parameterized keys","errorType":"validation","errorClass":"java.lang.IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/config/EncryptionOptions.java","lineNumber":295,"sourceCode":"    }\n\n    /**\n     * Prepares the parameterized keys provided in the configuration for {@link ISslContextFactory} to be passed in\n     * as the constructor for its implementation.\n     *\n     * @throws IllegalArgumentException in case any pre-defined key, as per {@link ConfigKey}, for the encryption\n     *                                  options is duplicated in the parameterized keys.\n     */\n    private void prepareSslContextFactoryParameterizedKeys(Map<String, Object> sslContextFactoryParameters)\n    {\n        if (ssl_context_factory.parameters != null)\n        {\n            Set<String> configKeys = ConfigKey.asSet();\n            for (Map.Entry<String, String> entry : ssl_context_factory.parameters.entrySet())\n            {\n                if (configKeys.contains(toLowerCaseLocalized(entry.getKey())))\n                {\n                    throw new IllegalArgumentException(\"SslContextFactory \" + ssl_context_factory.class_name + \" should \" +\n                                                       \"configure '\" + entry.getKey() + \"' as encryption_options instead of\" +\n                                                       \" parameterized keys\");\n                }\n                sslContextFactoryParameters.put(entry.getKey(), entry.getValue());\n            }\n        }\n    }\n\n    protected void fillSslContextParams(Map<String, Object> sslContextFactoryParameters)\n    {\n        /*\n         * Copy all configs to the Map to pass it on to the ISslContextFactory's implementation\n         */\n        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.KEYSTORE, this.keystore);\n        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.KEYSTORE_PASSWORD, this.keystore_password);\n        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.KEYSTORE_PASSWORD_FILE, this.keystore_password_file);\n        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.TRUSTSTORE, this.truststore);\n        putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.TRUSTSTORE_PASSWORD, this.truststore_password);","sourceCodeStart":277,"sourceCodeEnd":313,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/config/EncryptionOptions.java#L277-L313","documentation":"When an ssl_context_factory declares a 'parameters' map, its keys must not duplicate settings that belong to encryption_options. If a parameter key matches a known config key (case-insensitively), prepareSslContextFactoryParameterizedKeys throws IllegalArgumentException telling you to move it into encryption_options.","triggerScenarios":"cassandra.yaml with server_encryption_options.ssl_context_factory.parameters containing keys like 'protocol', 'cipher_suites', 'require_client_auth', etc., which overlap encryption_options fields.","commonSituations":"Migrating from old-style encryption options into a custom SslContextFactory and leaving standard encryption keys inside parameters; copy-pasted factory configs carrying encryption keys.","solutions":["Move the offending key/value out of parameters into the encryption_options section (or as factory-specific constructor args)","Rename the parameter if it is factory-specific and not a standard encryption option","Check the error message for the exact key name flagged"],"exampleFix":"// before\nssl_context_factory:\n  parameters:\n    require_client_auth: true\n// after\nserver_encryption_options:\n  require_client_auth: true","handlingStrategy":"validation","validationCode":"// Before deploy, diff ssl_context_factory.parameters keys against encryption_options keys\nfor (String key : factoryParameters.keySet()) {\n    if (ENCRYPTION_OPTION_KEYS.contains(key.toLowerCase(Locale.ROOT)))\n        throw new IllegalArgumentException(\"Move '\" + key + \"' to encryption_options\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    DatabaseDescriptor.applySslContextFactory(...);\n} catch (IllegalArgumentException e) {\n    logger.error(\"SSL factory parameter misplacement: {}\", e.getMessage());\n}","preventionTips":["Keep encryption_options-level settings in encryption_options, not factory parameters","Use parameters only for factory-specific constructor arguments","Case-insensitively audit parameter keys against known config keys"],"tags":["ssl","configuration","encryption-options"],"backgroundTag":"invalid-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}