{"record":{"id":"3e446812e645d4a9","repo":"apache/cassandra","slug":"could-not-read-any-certificates-from-the-given-pem","errorCode":null,"errorMessage":"Could not read any certificates from the given PEM","messagePattern":"Could not read any certificates from the given PEM","errorType":"exception","errorClass":"SSLException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java","lineNumber":338,"sourceCode":"\n        KeyStore keyStore = KeyStore.getInstance(DEFAULT_TARGET_STORETYPE);\n        keyStore.load(null, null);\n        keyStore.setKeyEntry(\"cassandra-ssl-keystore\", privateKey, keyPasswordArray, certChainArray);\n        return keyStore;\n    }\n\n    /**\n     * Builds KeyStore object given the {@link #DEFAULT_TARGET_STORETYPE} out of the PEM formatted certificates/public-key\n     * material.\n     * <p>\n     * It uses {@code cassandra-ssl-trusted-cert-<numeric-id>} as the alias for the created certificate-entry.\n     */\n    private KeyStore buildTrustStore() throws GeneralSecurityException, IOException\n    {\n        Certificate[] certChainArray = PEMReader.extractCertificates(pemEncodedTrustCertificates.key);\n        if (certChainArray == null || certChainArray.length == 0)\n        {\n            throw new SSLException(\"Could not read any certificates from the given PEM\");\n        }\n\n        KeyStore keyStore = KeyStore.getInstance(DEFAULT_TARGET_STORETYPE);\n        keyStore.load(null, null);\n        for (int i = 0; i < certChainArray.length; i++)\n        {\n            keyStore.setCertificateEntry(\"cassandra-ssl-trusted-cert-\" + (i + 1), certChainArray[i]);\n        }\n        return keyStore;\n    }\n\n    /**\n     * Enforces that the configuration specified a sole source of loading private keys - either {@code keystore} (the\n     * actual file must exist) or {@code private_key}, not both.\n     */\n    private void enforceSinglePrivateKeySource()\n    {\n        if (keystoreContext.hasKeystore() && !StringUtils.isEmpty(pemEncodedKeyContext.key))","sourceCodeStart":320,"sourceCodeEnd":356,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java#L320-L356","documentation":"In buildTrustStore, no CERTIFICATE sections could be parsed from the supplied PEM content (empty file, wrong format, or non-certificate blocks only). The code fails with 'Could not read any certificates from the given PEM' because at least one trusted certificate is required to build the trust KeyStore.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:338 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide a PEM file with valid certificate blocks for the truststore","Verify the PEM content includes BEGIN/END CERTIFICATE sections and fix the file or its path"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}