{"record":{"id":"6217d34f7265e032","repo":"apache/cassandra","slug":"hot-reloading-functionality-has-not-been-initializ","errorCode":null,"errorMessage":"Hot reloading functionality has not been initialized.","messagePattern":"Hot reloading functionality has not been initialized\\.","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/SSLFactory.java","lineNumber":187,"sourceCode":"     * Create a Netty {@link SslContext} with a supplied cipherFilter\n     */\n    static SslContext createNettySslContext(EncryptionOptions options, EncryptionOptions.ClientEncryptionOptions.ClientAuth clientAuth,\n                                            SocketType socketType, CipherSuiteFilter cipherFilter) throws IOException\n    {\n        return options.sslContextFactoryInstance.createNettySslContext(clientAuth, socketType,\n                                                                       cipherFilter);\n    }\n\n    /**\n     * Performs a lightweight check whether the certificate files have been refreshed.\n     *\n     * @throws IllegalStateException if {@link #initHotReloading(EncryptionOptions.ServerEncryptionOptions, EncryptionOptions, boolean)}\n     *                               is not called first\n     */\n    public static void checkCertFilesForHotReloading()\n    {\n        if (!isHotReloadingInitialized)\n            throw new IllegalStateException(\"Hot reloading functionality has not been initialized.\");\n        checkCachedContextsForReload(false);\n    }\n\n    /**\n     * Forces revalidation and loading of SSL certifcates if valid\n     */\n    public static void forceCheckCertFiles()\n    {\n        checkCachedContextsForReload(true);\n    }\n\n    private static void checkCachedContextsForReload(boolean forceReload)\n    {\n        List<CacheKey> keysToCheck = new ArrayList<>(Collections.list(cachedSslContexts.keys()));\n        while (!keysToCheck.isEmpty())\n        {\n            CacheKey key = keysToCheck.remove(keysToCheck.size()-1);\n            final EncryptionOptions opts = key.encryptionOptions;","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/SSLFactory.java#L169-L205","documentation":"Cassandra's SSLFactory supports hot reloading of TLS certificates, but this must first be enabled by calling initHotReloading(). checkCertFilesForHotReloading() performs a forced revalidation of cached SSL contexts, and throws IllegalStateException when the hot reloading machinery was never initialized, because there is nothing registered to check or reload.","triggerScenarios":"Calling SSLFactory.checkCertFilesForHotReloading() (directly or via tooling/JMX that forces a certificate check) when initHotReloading(ServerEncryptionOptions, EncryptionOptions, boolean) has not been called for the process, i.e. the static isHotReloadingInitialized flag is still false.","commonSituations":"Operators invoking a forced cert recheck on a node started without ssl_storage_encryption/options requiring hot reload; custom code or scripts calling checkCertFilesForHotReloading at startup before initHotReloading; test harnesses exercising reload paths without the init call; config where hot reloading is disabled so initHotReloading is skipped.","solutions":["Call SSLFactory.initHotReloading(ServerEncryptionOptions, EncryptionOptions, boolean) once at startup before any checkCertFilesForHotReloading() call.","If you rely on forced reloads (e.g. after rotating certs), ensure your node's configuration path initializes hot reloading (enabled encrypted transports trigger it).","Guard the call: only invoke checkCertFilesForHotReloading when hot reloading is known to be initialized in this JVM.","In tests, call initHotReloading in setup before exercising reload checks."],"exampleFix":"// before\nSSLFactory.checkCertFilesForHotReloading();\n\n// after\nSSLFactory.initHotReloading(serverEncryptionOptions, clientEncryptionOptions, true);\nSSLFactory.checkCertFilesForHotReloading();","handlingStrategy":"validation","validationCode":"// Java: check initialization before forcing a reload\njava.lang.reflect.Field f = SSLFactory.class.getDeclaredField(\"isHotReloadingInitialized\");\nf.setAccessible(true);\nif (!f.getBoolean(null)) {\n    SSLFactory.initHotReloading(serverEncryptionOptions, clientEncryptionOptions, true);\n}\nSSLFactory.checkCertFilesForHotReloading();","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always call initHotReloading during node startup when encrypted transports are used","Wrap forced reload calls in a helper that initializes on first use","In tests, initialize hot reloading in the setup phase"],"tags":["ssl","tls","lifecycle","hot-reload","illegal-state"],"backgroundTag":"invalid-state-transition","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}