{"record":{"id":"8580d55cb9c996b2","repo":"apache/cassandra","slug":"failed-to-build-trust-manager-store-for-secure-con-8580d5","errorCode":null,"errorMessage":"Failed to build trust manager store for secure connections","messagePattern":"Failed to build trust manager store for secure connections","errorType":"exception","errorClass":"SSLException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java","lineNumber":298,"sourceCode":"                {\n                    pemEncodedTrustCertificates.key = readPEMFile(trustStoreContext.filePath); // read PEM from the file\n                }\n\n                TrustManagerFactory tmf = TrustManagerFactory.getInstance(\n                algorithm == null ? TrustManagerFactory.getDefaultAlgorithm() : algorithm);\n                KeyStore ts = buildTrustStore();\n                tmf.init(ts);\n                return tmf;\n            }\n            else\n            {\n                throw new SSLException(\"Must provide truststore or trusted_certificates in configuration for \" +\n                                       \"PEMBasedSSlContextFactory\");\n            }\n        }\n        catch (Exception e)\n        {\n            throw new SSLException(\"Failed to build trust manager store for secure connections\", e);\n        }\n    }\n\n    private String readPEMFile(String file) throws IOException\n    {\n        return new String(Files.readAllBytes(File.getPath(file)));\n    }\n\n    /**\n     * Builds KeyStore object given the {@link #DEFAULT_TARGET_STORETYPE} out of the PEM formatted private key material.\n     * It uses {@code cassandra-ssl-keystore} as the alias for the created key-entry.\n     */\n    private static KeyStore buildKeyStore(final String pemEncodedKey, final String keyPassword) throws GeneralSecurityException, IOException\n    {\n        char[] keyPasswordArray = keyPassword != null ? keyPassword.toCharArray() : null;\n        PrivateKey privateKey = PEMReader.extractPrivateKey(pemEncodedKey, keyPassword);\n        Certificate[] certChainArray = PEMReader.extractCertificates(pemEncodedKey);\n        if (certChainArray == null || certChainArray.length == 0)","sourceCodeStart":280,"sourceCodeEnd":316,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java#L280-L316","documentation":"In buildTrustManagerFactory, loading the truststore/PEM certificates or initializing the TrustManagerFactory failed (unreadable file, bad password, unparseable certificates); the failure is wrapped as SSLException('Failed to build trust manager store for secure connections'). TLS trust setup fails at startup.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:298 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the trusted certificate PEM content is valid and parseable","Check truststore password/paths and certificate formats (BEGIN/END CERTIFICATE blocks), then restart"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}