{"record":{"id":"4ee87c1e582bf220","repo":"apache/cassandra","slug":"couldn-t-load-keystore","errorCode":null,"errorMessage":"couldn't load keystore","messagePattern":"couldn't load keystore","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/JKSKeyProvider.java","lineNumber":61,"sourceCode":"    static final String PROP_KEY_PW = \"key_password\";\n\n    private final KeyStore store;\n    private final boolean isJceks;\n    private final TransparentDataEncryptionOptions options;\n\n    public JKSKeyProvider(TransparentDataEncryptionOptions options)\n    {\n        this.options = options;\n        logger.info(\"initializing keystore from file {}\", options.get(PROP_KEYSTORE));\n        try (InputStream inputStream = Files.newInputStream(File.getPath(options.get(PROP_KEYSTORE))))\n        {\n            store = KeyStore.getInstance(options.get(PROP_KEYSTORE_TYPE));\n            store.load(inputStream, options.get(PROP_KEYSTORE_PW).toCharArray());\n            isJceks = store.getType().equalsIgnoreCase(\"jceks\");\n        }\n        catch (Exception e)\n        {\n            throw new RuntimeException(\"couldn't load keystore\", e);\n        }\n    }\n\n    public Key getSecretKey(String keyAlias) throws IOException\n    {\n        // there's a lovely behavior with jceks files that all aliases are lower-cased\n        if (isJceks)\n            keyAlias = toLowerCaseLocalized(keyAlias);\n\n        Key key;\n        try\n        {\n            String password = options.get(PROP_KEY_PW);\n            if (password == null || password.isEmpty())\n                password = options.get(PROP_KEYSTORE_PW);\n            key = store.getKey(keyAlias, password.toCharArray());\n        }\n        catch (Exception e)","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/JKSKeyProvider.java#L43-L79","documentation":"In the JKSKeyProvider constructor, KeyStore.load fails (missing keystore file, wrong password, or corrupt/invalid store) while initializing transparent data encryption, so an IOException('couldn't load keystore') is thrown. TDE cannot proceed without the key material.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/security/JKSKeyProvider.java:61 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify keystore file path, type (JCEKS/JKS), and keystore_password in transparent_data_encryption_options","Create the keystore with the expected type and password, then restart the node"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}