{"record":{"id":"3af7f9210c0eff3f","repo":"apache/cassandra","slug":"failed-to-build-trust-manager-store-for-secure-con","errorCode":null,"errorMessage":"failed to build trust manager store for secure connections","messagePattern":"failed to build trust manager store for secure connections","errorType":"exception","errorClass":"SSLException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/FileBasedSslContextFactory.java","lineNumber":202,"sourceCode":"     * @throws SSLException if any issues encountered during the build process\n     */\n    @Override\n    protected TrustManagerFactory buildTrustManagerFactory() throws SSLException\n    {\n        try (InputStream tsf = Files.newInputStream(File.getPath(trustStoreContext.filePath)))\n        {\n            final String algorithm = this.algorithm == null ? TrustManagerFactory.getDefaultAlgorithm() : this.algorithm;\n            TrustManagerFactory tmf = TrustManagerFactory.getInstance(algorithm);\n            KeyStore ts = KeyStore.getInstance(store_type);\n\n            final char[] truststorePassword = StringUtils.isEmpty(trustStoreContext.password) ? null : trustStoreContext.password.toCharArray();\n            ts.load(tsf, truststorePassword);\n            tmf.init(ts);\n            return tmf;\n        }\n        catch (Exception e)\n        {\n            throw new SSLException(\"failed to build trust manager store for secure connections\", e);\n        }\n    }\n\n    private KeyManagerFactory getKeyManagerFactory(final FileBasedStoreContext context) throws SSLException\n    {\n        try (InputStream ksf = Files.newInputStream(File.getPath(context.filePath)))\n        {\n            final String algorithm = this.algorithm == null ? KeyManagerFactory.getDefaultAlgorithm() : this.algorithm;\n            KeyManagerFactory kmf = KeyManagerFactory.getInstance(algorithm);\n            KeyStore ks = KeyStore.getInstance(store_type);\n            final char[] password = context.password.toCharArray();\n            ks.load(ksf, password);\n\n            if (!context.checkedExpiry)\n            {\n                checkExpiredCerts(ks);\n                context.checkedExpiry = true;\n            }","sourceCodeStart":184,"sourceCodeEnd":220,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/FileBasedSslContextFactory.java#L184-L220","documentation":"In buildTrustManagerFactory, any exception while loading the truststore file or initializing the TrustManagerFactory (bad password, missing/corrupt file, wrong store type) is caught and rethrown as SSLException('failed to build trust manager store for secure connections'). It means outbound/inbound TLS cannot establish trusted certificates.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/security/FileBasedSslContextFactory.java:202 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify truststore path, password, and type in the SSL configuration are correct","Ensure the truststore file exists, is readable, and contains valid certificates, then restart"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}