{"record":{"id":"8cc9c8f644a99602","repo":"apache/cassandra","slug":"no-certificate-present-on-connection","errorCode":null,"errorMessage":"No certificate present on connection","messagePattern":"No certificate present on connection","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java","lineNumber":208,"sourceCode":"\n        @Override\n        public boolean shouldSendAuthenticateMessage()\n        {\n            return false;\n        }\n\n        @Override\n        public boolean isComplete()\n        {\n            return true;\n        }\n\n        @Override\n        public AuthenticatedUser getAuthenticatedUser() throws AuthenticationException\n        {\n            if (clientCertificateChain == null || clientCertificateChain.length == 0)\n            {\n                throw new AuthenticationException(\"No certificate present on connection\");\n            }\n\n            if (!certificateValidator.isValidCertificate(clientCertificateChain))\n            {\n                String message = \"Invalid or not supported certificate\";\n                nospamLogger.error(message);\n                throw new AuthenticationException(message);\n            }\n\n            String identity = certificateValidator.identity(clientCertificateChain);\n            if (StringUtils.isEmpty(identity))\n            {\n                String msg = \"Unable to extract client identity from certificate for authentication\";\n                nospamLogger.error(msg);\n                throw new AuthenticationException(msg);\n            }\n            String role = identityCache.get(identity);\n            if (role == null)","sourceCodeStart":190,"sourceCodeEnd":226,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java#L190-L226","documentation":"AuthenticationException from MutualTlsAuthenticator's getAuthenticatedUser: the connection completed the SASL handshake but the client certificate chain is null or empty, so there is no certificate to validate an identity against. This is a client-side TLS configuration problem — the TLS layer accepted the connection without a peer certificate (client-auth not enforced at the socket).","triggerScenarios":"Thrown at src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java:208 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure the client to present its certificate during the TLS handshake","Enable/require mutual TLS (require_client_auth) on the server socket so certificate-less connections are rejected earlier","Verify the client's keystore contains the certificate and the trust path is intact"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}