{"record":{"id":"4e8cd68e7172c3fa","repo":"apache/cassandra","slug":"unable-to-create-instance-of-isslcontextfactory-fo","errorCode":null,"errorMessage":"Unable to create instance of ISslContextFactory for ","messagePattern":"Unable to create instance of ISslContextFactory for ","errorType":"exception","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/utils/FBUtilities.java","lineNumber":718,"sourceCode":"    }\n\n    public static ISslContextFactory newSslContextFactory(String className, Map<String,Object> parameters) throws ConfigurationException\n    {\n        if (!className.contains(\".\"))\n            className = \"org.apache.cassandra.security.\" + className;\n\n        try\n        {\n            Class<? extends ISslContextFactory> sslContextFactoryClass =\n                FBUtilities.classForNameWithoutInitialization(className, \"ISslContextFactory\", ISslContextFactory.class);\n            return sslContextFactoryClass.getConstructor(Map.class).newInstance(parameters);\n        }\n        catch (Exception ex)\n        {\n            // Surface the underlying load failure (e.g. ClassNotFoundException) as the direct cause rather than the\n            // intermediate ConfigurationException that reports it.\n            Throwable cause = ex instanceof ConfigurationException && ex.getCause() != null ? ex.getCause() : ex;\n            throw new ConfigurationException(\"Unable to create instance of ISslContextFactory for \" + className, cause);\n        }\n    }\n\n    public static AbstractCryptoProvider newCryptoProvider(String className, Map<String, String> parameters) throws ConfigurationException\n    {\n        try\n        {\n            if (!className.contains(\".\"))\n                className = \"org.apache.cassandra.security.\" + className;\n\n            Class<? extends AbstractCryptoProvider> cryptoProviderClass =\n                FBUtilities.classForNameWithoutInitialization(className, \"crypto provider class\", AbstractCryptoProvider.class);\n            return cryptoProviderClass.getConstructor(Map.class).newInstance(Collections.unmodifiableMap(parameters));\n        }\n        catch (Exception e)\n        {\n            // no need to wrap it in another ConfgurationException if FBUtilities.classForName might throw it\n            if (e instanceof ConfigurationException)","sourceCodeStart":700,"sourceCodeEnd":736,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/utils/FBUtilities.java#L700-L736","documentation":"newSslContextFactory reflectively constructs the configured ISslContextFactory implementation from its class name and parameters. All failures, including class-load errors from the nested classForNameWithoutInitialization call, are surfaced as a ConfigurationException naming the class. The underlying load failure is unwrapped and attached as the direct cause.","triggerScenarios":"server_encryption_options or client_encryption_options with an ssl_factory class name that is absent on the classpath, not an ISslContextFactory, missing a (Map) constructor, or whose constructor throws during node startup.","commonSituations":"Custom SSL factory jar not deployed; typo in ssl_factory FQCN; upgrade changed the required constructor signature; factory constructor throws reading keystore paths.","solutions":["Correct the ssl_factory value to a valid fully-qualified class name","Deploy the factory implementation jar to lib/ on all nodes and restart","Ensure the class implements ISslContextFactory and has a public (Map) constructor","Read the chained cause in the exception/log for the actual failure (ClassNotFound vs constructor error)"],"exampleFix":"// before (cassandra.yaml)\nserver_encryption_options:\n  ssl_factory: org.apache.cassandra.security.MySslFactory\n// after\nserver_encryption_options:\n  ssl_factory: org.apache.cassandra.security.CustomSslContextFactory","handlingStrategy":"validation","validationCode":"String cn = encOptions.get(\"ssl_factory\");\ntry { Class<?> c = Class.forName(cn, false, FBUtilities.class.getClassLoader());\n      if (!ISslContextFactory.class.isAssignableFrom(c)) throw new IllegalArgumentException(cn + \" is not an ISslContextFactory\"); }\ncatch (ClassNotFoundException e) { throw new IllegalArgumentException(\"ssl_factory class not found: \" + cn, e); }","typeGuard":"boolean isValidSslFactory(String cn) {\n    try { return ISslContextFactory.class.isAssignableFrom(Class.forName(cn, false, Thread.currentThread().getContextClassLoader())); }\n    catch (Throwable t) { return false; }\n}","tryCatchPattern":"try {\n    sslContextFactory = FBUtilities.newSslContextFactory(className, parameters);\n} catch (ConfigurationException e) {\n    throw new IllegalStateException(\"Check ssl_factory config: \" + className, e.getCause());\n}","preventionTips":["Use Cassandra's DefaultSslContextFactory unless customization is required","Deploy factory jars cluster-wide before enabling encryption options","Verify constructor signature (Map) survives upgrades","Log and read the cause chain — it names the real failure"],"tags":["config","ssl","tls","reflection"],"backgroundTag":"class-not-found","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}