{"record":{"id":"45daabab84a6d160","repo":"apache/cassandra","slug":"could-not-read-any-certificates-for-the-certchain","errorCode":null,"errorMessage":"Could not read any certificates for the certChain for the private key","messagePattern":"Could not read any certificates for the certChain for the private key","errorType":"exception","errorClass":"SSLException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java","lineNumber":318,"sourceCode":"    }\n\n    private String readPEMFile(String file) throws IOException\n    {\n        return new String(Files.readAllBytes(File.getPath(file)));\n    }\n\n    /**\n     * Builds KeyStore object given the {@link #DEFAULT_TARGET_STORETYPE} out of the PEM formatted private key material.\n     * It uses {@code cassandra-ssl-keystore} as the alias for the created key-entry.\n     */\n    private static KeyStore buildKeyStore(final String pemEncodedKey, final String keyPassword) throws GeneralSecurityException, IOException\n    {\n        char[] keyPasswordArray = keyPassword != null ? keyPassword.toCharArray() : null;\n        PrivateKey privateKey = PEMReader.extractPrivateKey(pemEncodedKey, keyPassword);\n        Certificate[] certChainArray = PEMReader.extractCertificates(pemEncodedKey);\n        if (certChainArray == null || certChainArray.length == 0)\n        {\n            throw new SSLException(\"Could not read any certificates for the certChain for the private key\");\n        }\n\n        KeyStore keyStore = KeyStore.getInstance(DEFAULT_TARGET_STORETYPE);\n        keyStore.load(null, null);\n        keyStore.setKeyEntry(\"cassandra-ssl-keystore\", privateKey, keyPasswordArray, certChainArray);\n        return keyStore;\n    }\n\n    /**\n     * Builds KeyStore object given the {@link #DEFAULT_TARGET_STORETYPE} out of the PEM formatted certificates/public-key\n     * material.\n     * <p>\n     * It uses {@code cassandra-ssl-trusted-cert-<numeric-id>} as the alias for the created certificate-entry.\n     */\n    private KeyStore buildTrustStore() throws GeneralSecurityException, IOException\n    {\n        Certificate[] certChainArray = PEMReader.extractCertificates(pemEncodedTrustCertificates.key);\n        if (certChainArray == null || certChainArray.length == 0)","sourceCodeStart":300,"sourceCodeEnd":336,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java#L300-L336","documentation":"In buildKeyStore, parsing the PEM-encoded key material yielded no certificates for the private key's chain (missing CERTIFICATE blocks or the key block only). The code throws KeyError/IOException-style failure with 'Could not read any certificates for the certChain for the private key' because a KeyStore key entry requires a certificate chain.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:318 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the PEM file used as the keystore contains the full certificate chain along with the private key","Re-export the key/cert pair including certificates and update the config path"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}