{"record":{"id":"41f4dbaec161670e","repo":"apache/cassandra","slug":"failed-to-initialize-crypto-provider-s","errorCode":null,"errorMessage":"Failed to initialize crypto provider %s","messagePattern":"Failed to initialize crypto provider (.+?)","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/config/DatabaseDescriptor.java","lineNumber":1655,"sourceCode":"            throw new ConfigurationException(\"Failed to initialize crypto provider, class_name cannot be null\");\n\n        if (conf.crypto_provider.parameters == null)\n            conf.crypto_provider.parameters = new HashMap<>();\n\n        Map<String, String> cryptoProviderParameters = new HashMap<>(conf.crypto_provider.parameters);\n        cryptoProviderParameters.putIfAbsent(AbstractCryptoProvider.FAIL_ON_MISSING_PROVIDER_KEY, \"false\");\n\n        try\n        {\n            cryptoProvider = FBUtilities.newCryptoProvider(conf.crypto_provider.class_name, cryptoProviderParameters);\n            cryptoProvider.install();\n        }\n        catch (Exception e)\n        {\n            if (e instanceof ConfigurationException)\n                throw (ConfigurationException) e;\n            else\n                throw new ConfigurationException(String.format(\"Failed to initialize crypto provider %s\", conf.crypto_provider.class_name), e);\n        }\n    }\n\n    public static void applySeedProvider()\n    {\n        // load the seeds for node contact points\n        if (conf.seed_provider == null)\n        {\n            throw new ConfigurationException(\"seeds configuration is missing; a minimum of one seed is required.\", false);\n        }\n        try\n        {\n            Class<? extends SeedProvider> seedProviderClass =\n                FBUtilities.classForNameWithoutInitialization(conf.seed_provider.class_name, \"seed provider\", SeedProvider.class);\n            seedProvider = (SeedProvider) seedProviderClass.getConstructor(Map.class).newInstance(conf.seed_provider.parameters);\n        }\n        // there are about 5 checked exceptions that could be thrown here.\n        catch (Exception e)","sourceCodeStart":1637,"sourceCodeEnd":1673,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/config/DatabaseDescriptor.java#L1637-L1673","documentation":"After a crypto provider class name is known, applyCryptoProvider() reflects/loads the class and installs it. Any exception during that installation (class not found, provider init failure, invalid parameters, missing algorithm) is rethrown as a ConfigurationException naming the configured class, unless it is already a ConfigurationException.","triggerScenarios":"applyCryptoProvider() is called and the configured crypto_provider class fails to load or initialize: wrong class_name, provider JAR absent from the classpath, incompatible provider with the JVM/JDK, or bad parameters map (e.g. fail-on-missing-provider behavior).","commonSituations":"Third-party JCE provider (e.g. BouncyCastle, AWS CloudHSM PKCS11) JAR not shipped to the node; typo in fully-qualified class name; JDK upgrade changes available algorithms; provider requires an HSM that is unreachable.","solutions":["Fix crypto_provider.class_name to the exact fully-qualified class and ensure its JAR is on the classpath (lib/) on every node","Check the wrapped cause in the log for the real init failure (missing algorithm, HSM connectivity, bad parameters)","Align provider parameters in cassandra.yaml with the provider's documented options; set FAIL_ON_MISSING_PROVIDER to false only if fallback is intended","Verify provider compatibility with the installed JDK and re-test with a single-node dev cluster"],"exampleFix":"// cassandra.yaml before\ncrypto_provider:\n  class_name: com.example.MyCryptoProvider\n// after\ncrypto_provider:\n  class_name: org.apache.cassandra.security.DefaultCryptoProvider\n  parameters: {}","handlingStrategy":"try-catch","validationCode":"String cls = System.getProperty(\"cassandra.crypto_provider_class_name\", conf.crypto_provider != null ? conf.crypto_provider.class_name : null);\nif (cls != null) Class.forName(cls); // fail fast if provider JAR missing","typeGuard":null,"tryCatchPattern":"try { DatabaseDescriptor.applyCryptoProvider(); } catch (ConfigurationException e) {\n    logger.error(\"Crypto provider {} failed to initialize: {}\", e.getCause());\n}","preventionTips":["Copy third-party provider JARs into lib/ on every node (not just one)","Pin provider versions against your JDK; retest after JDK upgrades","Verify HSM/network dependencies of the provider are reachable at boot"],"tags":["cassandra","crypto-provider","classpath"],"backgroundTag":"module-init-failed","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}