{"record":{"id":"617c74f9ad96dd1c","repo":"apache/cassandra","slug":"certificate-from-with-identity-will-exp","errorCode":null,"errorMessage":"Certificate from {}:{} with identity '{}' will expire in {}","messagePattern":"Certificate from (.+?):(.+?) with identity '(.+?)' will expire in (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/java/org/apache/cassandra/auth/MutualTlsInternodeAuthenticator.java","lineNumber":203,"sourceCode":"            String identity = certificateValidator.identity(certificates);\n            if (!certificateValidator.isValidCertificate(certificates))\n            {\n                noSpamLogger.error(\"Not a valid certificate from {}:{} with identity '{}'\", remoteAddress, remotePort, identity);\n                return false;\n            }\n\n            if (!trustedIdentities.contains(identity))\n            {\n                noSpamLogger.error(\"Unable to authenticate user {}\", identity);\n                return false;\n            }\n\n            int minutesToCertificateExpiration = certificateValidityPeriodValidator.validate(certificates);\n\n            if (certificateValidityWarnThreshold != null\n                && minutesToCertificateExpiration < certificateValidityWarnThreshold.toMinutes())\n            {\n                noSpamLogger.warn(\"Certificate from {}:{} with identity '{}' will expire in {}\",\n                                  remoteAddress, remotePort, identity,\n                                  MutualTlsUtil.toHumanReadableCertificateExpiration(minutesToCertificateExpiration));\n            }\n            MutualTlsMetrics.instance.internodeCertificateExpirationDays.update(MutualTlsUtil.minutesToDays(minutesToCertificateExpiration));\n\n            return true;\n        }\n        // Outbound connections don't need to be authenticated again in certificate based connections. SSL handshake\n        // makes sure that we are talking to valid server by checking root certificates of the server in the\n        // truststore of the client.\n        return true;\n    }\n\n    @VisibleForTesting\n    List<String> getIdentitiesFromKeyStore(final String outboundKeyStorePath,\n                                           final String outboundKeyStorePassword,\n                                           final String storeType)\n    {","sourceCodeStart":185,"sourceCodeEnd":221,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/MutualTlsInternodeAuthenticator.java#L185-L221","documentation":"This is a non-spammy warning (not an exception) logged by MutualTlsInternodeAuthenticator during mTLS internode authentication. The peer's client certificate is still valid (authentication succeeds, returns true), but it will expire soon — within the configured certificate_validity_warn_threshold. Cassandra emits it so operators rotate certificates before nodes start failing to connect.","triggerScenarios":"A peer node presents a client certificate whose remaining validity (minutesToCertificateExpiration from certificateValidityPeriodValidator.validate) is less than certificateValidityWarnThreshold while authenticating an internode connection.","commonSituations":"Long-running clusters with certificates generated once (e.g. by certmanager or manual openssl) that are approaching expiry without an automated rotation; threshold configured aggressively high (e.g. warn 90 days out); clocks skewed so remaining validity appears shorter than expected.","solutions":["Renew/reissue the client certificate on the remote node and restart or hot-reload its keystore/truststore (SSLFactory hot-reloading).","Enable automated certificate rotation (e.g. cert-manager, vault) and distribute new keystores to all nodes.","If the warning is too noisy for your ops practice, adjust certificate_validity_warn_threshold in cassandra.yaml to a smaller value.","Watch internode_certificate_expiration_days metric (updated right after this log) to track worst-case expiry across the cluster."],"exampleFix":"// before\ncertificate_validity_warn_threshold: 90d  // warns constantly as cert ages\n// after\ncertificate_validity_warn_threshold: 14d  // plus automated rotation so certs are renewed before the threshold","handlingStrategy":"validation","validationCode":"// Operator-side check before/alongside deployment\n// Track Cassandra's own metric instead of calling the API:\n// org.apache.cassandra.metrics: name=internode_certificate_expiration_days\n// Alert when min value < warn threshold days.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Automate certificate rotation (cert-manager/Vault) well before the warn threshold.","Set certificate_validity_warn_threshold to give ops enough lead time.","Alert on the internode_certificate_expiration_days metric minimum.","Keep node clocks NTP-synchronized so validity calculations are accurate."],"tags":["tls","certificate-expiry","internode","authentication"],"backgroundTag":"certificate-expiration-warning","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}