{"record":{"id":"3aa020899aee522f","repo":"apache/cassandra","slug":"must-provide-truststore-or-trusted-certificates-in","errorCode":null,"errorMessage":"Must provide truststore or trusted_certificates in configuration for PEMBasedSSlContextFactory","messagePattern":"Must provide truststore or trusted_certificates in configuration for PEMBasedSSlContextFactory","errorType":"exception","errorClass":"SSLException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java","lineNumber":292,"sourceCode":"    {\n        try\n        {\n            if (hasTruststore())\n            {\n                if (pemEncodedTrustCertificates.maybeFilebasedKey)\n                {\n                    pemEncodedTrustCertificates.key = readPEMFile(trustStoreContext.filePath); // read PEM from the file\n                }\n\n                TrustManagerFactory tmf = TrustManagerFactory.getInstance(\n                algorithm == null ? TrustManagerFactory.getDefaultAlgorithm() : algorithm);\n                KeyStore ts = buildTrustStore();\n                tmf.init(ts);\n                return tmf;\n            }\n            else\n            {\n                throw new SSLException(\"Must provide truststore or trusted_certificates in configuration for \" +\n                                       \"PEMBasedSSlContextFactory\");\n            }\n        }\n        catch (Exception e)\n        {\n            throw new SSLException(\"Failed to build trust manager store for secure connections\", e);\n        }\n    }\n\n    private String readPEMFile(String file) throws IOException\n    {\n        return new String(Files.readAllBytes(File.getPath(file)));\n    }\n\n    /**\n     * Builds KeyStore object given the {@link #DEFAULT_TARGET_STORETYPE} out of the PEM formatted private key material.\n     * It uses {@code cassandra-ssl-keystore} as the alias for the created key-entry.\n     */","sourceCodeStart":274,"sourceCodeEnd":310,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java#L274-L310","documentation":"In buildTrustManagerFactory, when neither a truststore nor inline trusted_certificates is configured, the factory throws SSLException('Must provide truststore or trusted_certificates in configuration for PEMBasedSSlContextFactory'). Without trust anchors, TLS peers cannot be authenticated, so context construction fails.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:292 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure truststore or trusted_certificates in the PEM SSL options","Point the truststore path to a valid PEM file containing trusted certificates"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}