{"record":{"id":"7249ecba37e1c51a","repo":"apache/cassandra","slug":"skeystore-password-and-skey-password-both-co","errorCode":null,"errorMessage":"'%skeystore_password' and '%skey_password' both configurations are given and the values do not match","messagePattern":"'(.+?)keystore_password' and '(.+?)key_password' both configurations are given and the values do not match","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java","lineNumber":111,"sourceCode":"    private PEMBasedKeyStoreContext pemEncodedTrustCertificates;\n    private PEMBasedKeyStoreContext pemEncodedKeyContext;\n    private PEMBasedKeyStoreContext pemEncodedOutboundKeyContext;\n\n    public PEMBasedSslContextFactory()\n    {\n    }\n\n    private void validatePasswords()\n    {\n        boolean shouldThrow = !keystoreContext.passwordMatchesIfPresent(pemEncodedKeyContext.password)\n                              || !outboundKeystoreContext.passwordMatchesIfPresent(pemEncodedOutboundKeyContext.password);\n        boolean outboundPasswordMismatch = !outboundKeystoreContext.passwordMatchesIfPresent(pemEncodedOutboundKeyContext.password);\n        String keyName = outboundPasswordMismatch ? \"outbound_\" : \"\";\n\n        if (shouldThrow)\n        {\n            final String msg = String.format(\"'%skeystore_password' and '%skey_password' both configurations are given and the values do not match\", keyName, keyName);\n            throw new IllegalArgumentException(msg);\n        }\n    }\n\n    public PEMBasedSslContextFactory(Map<String, Object> parameters)\n    {\n        super(parameters);\n        final String pemEncodedKey = getString(ConfigKey.ENCODED_KEY.getKeyName());\n        final String pemEncodedKeyPassword = StringUtils.defaultString(getString(ConfigKey.KEY_PASSWORD.getKeyName()), keystoreContext.password);\n        pemEncodedKeyContext = new PEMBasedKeyStoreContext(pemEncodedKey, pemEncodedKeyPassword, StringUtils.isEmpty(pemEncodedKey), keystoreContext);\n\n        final String pemEncodedOutboundKey = StringUtils.defaultString(getString(ConfigKey.OUTBOUND_ENCODED_KEY.getKeyName()), pemEncodedKey);\n        final String outboundKeyPassword = StringUtils.defaultString(StringUtils.defaultString(getString(ConfigKey.OUTBOUND_ENCODED_KEY_PASSWORD.getKeyName()),\n                                                                                               outboundKeystoreContext.password), pemEncodedKeyPassword);\n        pemEncodedOutboundKeyContext = new PEMBasedKeyStoreContext(pemEncodedKey, outboundKeyPassword, StringUtils.isEmpty(pemEncodedOutboundKey), outboundKeystoreContext);\n\n        validatePasswords();\n\n        if (!StringUtils.isEmpty(trustStoreContext.password))","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java#L93-L129","documentation":"Fired in PEMBasedSslContextFactory.validatePasswords (called from the constructor): the inline keystore_password and key_password are both configured but do not match (same check for outbound pairs). For PEM, keystore and key passwords must be identical when both are provided, so a ConfigurationException is thrown at startup.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:111 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Make keystore_password and key_password identical in the PEM SSL configuration, or remove key_password so keystore_password is used","Update cassandra.yaml so the passwords match, then restart"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}