{"record":{"id":"49f2eac519892910","repo":"apache/cassandra","slug":"pem-based-truststore-should-not-be-using-password","errorCode":null,"errorMessage":"PEM based truststore should not be using password. Ignoring the given value in 'truststore_password' configuration.","messagePattern":"PEM based truststore should not be using password\\. Ignoring the given value in 'truststore_password' configuration\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java","lineNumber":131,"sourceCode":"    }\n\n    public PEMBasedSslContextFactory(Map<String, Object> parameters)\n    {\n        super(parameters);\n        final String pemEncodedKey = getString(ConfigKey.ENCODED_KEY.getKeyName());\n        final String pemEncodedKeyPassword = StringUtils.defaultString(getString(ConfigKey.KEY_PASSWORD.getKeyName()), keystoreContext.password);\n        pemEncodedKeyContext = new PEMBasedKeyStoreContext(pemEncodedKey, pemEncodedKeyPassword, StringUtils.isEmpty(pemEncodedKey), keystoreContext);\n\n        final String pemEncodedOutboundKey = StringUtils.defaultString(getString(ConfigKey.OUTBOUND_ENCODED_KEY.getKeyName()), pemEncodedKey);\n        final String outboundKeyPassword = StringUtils.defaultString(StringUtils.defaultString(getString(ConfigKey.OUTBOUND_ENCODED_KEY_PASSWORD.getKeyName()),\n                                                                                               outboundKeystoreContext.password), pemEncodedKeyPassword);\n        pemEncodedOutboundKeyContext = new PEMBasedKeyStoreContext(pemEncodedKey, outboundKeyPassword, StringUtils.isEmpty(pemEncodedOutboundKey), outboundKeystoreContext);\n\n        validatePasswords();\n\n        if (!StringUtils.isEmpty(trustStoreContext.password))\n        {\n            logger.warn(\"PEM based truststore should not be using password. Ignoring the given value in \" +\n                        \"'truststore_password' configuration.\");\n        }\n\n        final String pemEncodedCerts = getString(ConfigKey.ENCODED_CERTIFICATES.getKeyName());\n        pemEncodedTrustCertificates = new PEMBasedKeyStoreContext(pemEncodedCerts, null, StringUtils.isEmpty(pemEncodedCerts), trustStoreContext);\n        enforceSinglePrivateKeySource();\n        enforceSingleTurstedCertificatesSource();\n    }\n\n    /**\n     * Decides if this factory has a keystore defined - key material specified in files or inline to the configuration.\n     *\n     * @return {@code true} if there is a keystore defined; {@code false} otherwise\n     */\n    @Override\n    public boolean hasKeystore()\n    {\n        return pemEncodedKeyContext.maybeFilebasedKey","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java#L113-L149","documentation":"PEMBasedSslContextFactory's constructor validates that PEM truststores are passwordless. PEM-encoded trust certificates are public material, so a configured 'truststore_password' is meaningless; the factory logs this warning and ignores the value. It does not fail startup, but indicates a config mistake.","triggerScenarios":"Constructing PEMBasedSslContextFactory with server/client_encryption_options of type 'pem' where the trustStoreContext.password field is non-empty in cassandra.yaml.","commonSituations":"Copy-pasting keystore-style config (with password) from JKS setups into a PEM config; migrating from JKS to PEM and leaving truststore_password behind.","solutions":["Remove the 'truststore_password' entry from the PEM truststore config in cassandra.yaml.","Keep passwords only for the PEM private key (outbound_key_password / key_password).","Restart and confirm the warning disappears."],"exampleFix":"// before (cassandra.yaml)\ntruststore: conf/truststore.pem\ntruststore_password: changeit\n// after\ntruststore: conf/truststore.pem\n# truststore_password removed (not used for PEM truststores)","handlingStrategy":"validation","validationCode":"// validate PEM config before node startup\nif (config.clientEncryptionOptions.truststorePassword != null && \"pem\".equals(config.clientEncryptionOptions.type))\n    throw new IllegalArgumentException(\"truststore_password must be empty for PEM truststores\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use a config linting checklist when migrating JKS->PEM: drop truststore_password, keep key passwords only.","Keep JKS and PEM config templates separate to avoid copy-paste leakage.","Treat this warning as config debt and fix it the first time it appears."],"tags":["tls","pem","configuration","ssl"],"backgroundTag":"invalid-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}