{"record":{"id":"41ad975a5a36c8b9","repo":"apache/cassandra","slug":"no-ciphers-left-after-filtering-supported-cipher-s","errorCode":null,"errorMessage":"No ciphers left after filtering supported cipher suite","messagePattern":"No ciphers left after filtering supported cipher suite","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/SSLFactory.java","lineNumber":348,"sourceCode":"                {\n                    break;\n                }\n                if (supportedCiphers.contains(c))\n                {\n                    newCiphers.add(c);\n                }\n                else\n                {\n                    if (settingDescription != null)\n                    {\n                        logger.warn(\"Dropping unsupported cipher_suite {} from {} configuration\",\n                                    c, toLowerCaseLocalized(settingDescription));\n                    }\n                }\n            }\n            if (newCiphers.isEmpty())\n            {\n                throw new IllegalStateException(\"No ciphers left after filtering supported cipher suite\");\n            }\n\n            return newCiphers.toArray(new String[0]);\n        }\n    }\n\n    private static boolean filterOutSSLv2Hello(String string)\n    {\n        return !string.equals(\"SSLv2Hello\");\n    }\n\n    public static void validateSslContext(String contextDescription, EncryptionOptions options, EncryptionOptions.ClientEncryptionOptions.ClientAuth clientAuth, boolean logProtocolAndCiphers) throws IOException\n    {\n        if (options != null && options.tlsEncryptionPolicy() != EncryptionOptions.TlsEncryptionPolicy.UNENCRYPTED)\n        {\n            try\n            {\n                CipherSuiteFilter loggingCipherSuiteFilter = logProtocolAndCiphers ? new LoggingCipherSuiteFilter(contextDescription)","sourceCodeStart":330,"sourceCodeEnd":366,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/SSLFactory.java#L330-L366","documentation":"SSLFactory.filterCipherSuites() takes the configured cipher suite list, filters it down to ciphers supported by the installed JDK/JCE provider, and throws IllegalStateException if filtering removes every cipher. This fail-fast guards against starting TLS with an empty cipher list, which would make every handshake fail anyway.","triggerScenarios":"cassandra.yaml (or EncryptionOptions) configures cipher_suites whose entries are all unsupported by the current JVM (e.g. only non-JDK ciphers, or typos/case mismatches after lowercasing), so the filtered set is empty.","commonSituations":"Migrating to a JDK (e.g. FIPS or newer/older JDK) that dropped or renamed cipher suites; copying cipher lists from OpenSSL-based tools into Cassandra config; typos in cipher names in cassandra.yaml.","solutions":["List the ciphers actually supported by your JVM (e.g. via 'jdk.tls.disabledAlgorithms' awareness or SSLContext supported cipher suites) and set cipher_suites in cassandra.yaml to a non-empty intersection.","Remove obsolete cipher names or correct their spelling/case in cipher_suites.","Check $JAVA_HOME/jre/lib/security/java.security 'jdk.tls.disabledAlgorithms' — re-enable needed ciphers or pick different ones.","If a provider (e.g. BouncyCastle/FIPS) is expected to supply the ciphers, verify it is installed and registered."],"exampleFix":"# before (cassandra.yaml)\nserver_encryption_options:\n  cipher_suites: [TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384-TYPO]\n\n# after\nserver_encryption_options:\n  cipher_suites: [TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]","handlingStrategy":"validation","validationCode":"// Java: verify at least one configured cipher is supported before applying config\nString[] supported = SSLContext.getDefault().getSupportedSSLParameters().getCipherSuites();\nSet<String> supportedSet = new HashSet<>();\nfor (String c : supported) supportedSet.add(c.toLowerCase(Locale.ROOT));\nList<String> configured = encryptionOptions.cipher_suites; // from cassandra.yaml\nif (configured == null || configured.isEmpty() ||\n    configured.stream().noneMatch(c -> supportedSet.contains(c.toLowerCase(Locale.ROOT)))) {\n    throw new IllegalArgumentException(\"No configured cipher suites are supported by this JVM\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Cross-check cipher_suites in cassandra.yaml against the JVM's supported cipher list after every JDK upgrade","Avoid copying OpenSSL cipher names into Cassandra config","Keep a known-good default (omit cipher_suites) unless you need to restrict them","Review jdk.tls.disabledAlgorithms when changing cipher configuration"],"tags":["ssl","tls","ciphersuite","configuration"],"backgroundTag":"invalid-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}