{"record":{"id":"59517687f98e4f08","repo":"apache/cassandra","slug":"must-provide-outbound-keystore-or-outbound-private","errorCode":null,"errorMessage":"Must provide outbound_keystore or outbound_private_key in configuration for PEMBasedSSlContextFactory","messagePattern":"Must provide outbound_keystore or outbound_private_key in configuration for PEMBasedSSlContextFactory","errorType":"exception","errorClass":"SSLException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java","lineNumber":257,"sourceCode":"                if (pemBasedKeyStoreContext.maybeFilebasedKey)\n                {\n                    pemBasedKeyStoreContext.key = readPEMFile(keyStoreContext.filePath); // read PEM from the file\n                }\n\n                KeyManagerFactory kmf = KeyManagerFactory.getInstance(\n                algorithm == null ? KeyManagerFactory.getDefaultAlgorithm() : algorithm);\n                KeyStore ks = buildKeyStore(pemBasedKeyStoreContext.key, pemBasedKeyStoreContext.password);\n                if (!keyStoreContext.checkedExpiry)\n                {\n                    checkExpiredCerts(ks);\n                    keyStoreContext.checkedExpiry = true;\n                }\n                kmf.init(ks, pemBasedKeyStoreContext.password != null ? pemBasedKeyStoreContext.password.toCharArray() : null);\n                return kmf;\n            }\n            else\n            {\n                throw new SSLException(\"Must provide outbound_keystore or outbound_private_key in configuration for PEMBasedSSlContextFactory\");\n            }\n        }\n        catch (Exception e)\n        {\n            throw new SSLException(\"Failed to build key manager store for secure connections\", e);\n        }\n    }\n\n    /**\n     * Builds TrustManagerFactory from the PEM based truststore.\n     *\n     * @return TrustManagerFactory from the PEM based truststore\n     * @throws SSLException if any issues encountered during the build process\n     */\n    @Override\n    protected TrustManagerFactory buildTrustManagerFactory() throws SSLException\n    {\n        try","sourceCodeStart":239,"sourceCodeEnd":275,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java#L239-L275","documentation":"In buildKeyManagerFactory, when no inline PEM key material and no usable keystore is configured for the outbound context, the factory throws SSLException('Must provide outbound_keystore or outbound_private_key in configuration for PEMBasedSSlContextFactory'). Client-to-client (outbound) TLS cannot be built without key material.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:257 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure outbound_keystore or outbound_private_key (plus certificate) in the PEM SSL options when outbound encryption is used","Disable outbound client encryption if it is not required"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}