{"record":{"id":"6dbc17ac74498f7f","repo":"apache/cassandra","slug":"skeystore-password-must-be-specified","errorCode":null,"errorMessage":"'%skeystore_password' must be specified","messagePattern":"'(.+?)keystore_password' must be specified","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/FileBasedSslContextFactory.java","lineNumber":145,"sourceCode":"            }\n            hotReloadableFiles = fileList;\n        }\n    }\n\n    /**\n     * Validates the given keystore password.\n     *\n     * @param isOutboundKeystore {@code true} for the {@code outbound_keystore_password};{@code false} otherwise\n     * @param password           value\n     * @throws IllegalArgumentException if the {@code password} is null\n     */\n    protected void validatePassword(boolean isOutboundKeystore, String password)\n    {\n        if (password == null)\n        {\n            String keyName = isOutboundKeystore ? \"outbound_\" : \"\";\n            final String msg = format(\"'%skeystore_password' must be specified\", keyName);\n            throw new IllegalArgumentException(msg);\n        }\n    }\n\n    /**\n     * Builds required KeyManagerFactory from the file based keystore. It also checks for the PrivateKey's certificate's\n     * expiry and logs {@code warning} for each expired PrivateKey's certitificate.\n     *\n     * @return KeyManagerFactory built from the file based keystore.\n     * @throws SSLException if any issues encountered during the build process\n     * @throws IllegalArgumentException if the validation for the {@code keystore_password} fails\n     * @see #validatePassword(boolean, String)\n     */\n    @Override\n    protected KeyManagerFactory buildKeyManagerFactory() throws SSLException\n    {\n        /*\n         * Validation of the password is delayed until this point to allow nullable keystore passwords\n         * for other use-cases (CASSANDRA-18124).","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/FileBasedSslContextFactory.java#L127-L163","documentation":"Fired in FileBasedSslContextFactory.validatePassword when the keystore password (or outbound_keystore_password, depending on the flag) is null in cassandra.yaml. The factory cannot build key/trust managers without it, so it throws IllegalArgumentException during SSL context setup at startup or on config validation.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/security/FileBasedSslContextFactory.java:145 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set keystore_password (or outbound_keystore_password) in cassandra.yaml server_encryption_options/client_encryption_options","Use keystore_password_file to supply the password from a file instead of inline config"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}