{"record":{"id":"902125c319e57caf","repo":"apache/cassandra","slug":"failed-to-create-ssl-context-using","errorCode":null,"errorMessage":"Failed to create SSL context using ","messagePattern":"Failed to create SSL context using ","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/SSLFactory.java","lineNumber":418,"sourceCode":"                    finally\n                    {\n                        engine.closeInbound();\n                        engine.closeOutbound();\n                        ReferenceCountUtil.release(engine);\n                    }\n                }\n                finally\n                {\n                    ReferenceCountUtil.release(serverSslContext);\n                }\n\n                // Make sure it is possible to build the client context too\n                SslContext clientSslContext = createNettySslContext(options, clientAuth, SocketType.CLIENT);\n                ReferenceCountUtil.release(clientSslContext);\n            }\n            catch (Exception e)\n            {\n                throw new IOException(\"Failed to create SSL context using \" + contextDescription, e);\n            }\n        }\n    }\n\n    /**\n     * Sanity checks all certificates to ensure we can actually load them\n     */\n    public static void validateSslCerts(EncryptionOptions.ServerEncryptionOptions serverOpts, EncryptionOptions clientOpts) throws IOException\n    {\n        validateSslContext(\"server_encryption_options\", serverOpts, REQUIRED, false);\n        validateSslContext(\"client_encryption_options\", clientOpts, clientOpts.getClientAuth(), false);\n    }\n\n    static class CacheKey\n    {\n        private final EncryptionOptions encryptionOptions;\n        private final SocketType socketType;\n        private final String contextDescription;","sourceCodeStart":400,"sourceCodeEnd":436,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/SSLFactory.java#L400-L436","documentation":"validateSslContext() sanity-checks that both server and client Netty SSL contexts can actually be built from the given EncryptionOptions. When building the context throws for any reason (unreadable keystore, bad password, unsupported algorithm, invalid truststore), the exception is wrapped in an IOException whose message names the context being built; the original cause carries the real problem.","triggerScenarios":"Calling validateSslContext (via checkCachedContextsForReload during hot reload, or validateSslCerts during startup/cert sanity checks) with EncryptionOptions pointing to a keystore/truststore that cannot be loaded or turned into a Netty SslContext.","commonSituations":"keystore/truststore file missing or unreadable due to permissions; wrong keystore_password/truststore_password; expired or corrupt certificates; algorithm disabled by jdk.tls.disabledAlgorithms; PEM vs JKS format mismatch after config changes.","solutions":["Read the 'caused by' of this IOException — it names the real failure (file not found, bad password, etc.) and fix that.","Verify keystore/truststore paths and that the cassandra user can read them; check passwords in cassandra.yaml.","Validate the store with keytool -list to confirm format (JKS/PKCS12/PEM) and certificate validity.","Check java.security jdk.tls.disabledAlgorithms and protocol settings against the configured protocols/ciphers.","After fixing certs, re-run validation or restart; for hot reload, ensure reloaded options pass validateSslContext."],"exampleFix":"// before (config)\nserver_encryption_options:\n  keystore: /etc/cassandra/keystore.jks\n  keystore_password: wrongpass\n\n// after\nserver_encryption_options:\n  keystore: /etc/cassandra/keystore.jks\n  keystore_password: correctpass","handlingStrategy":"try-catch","validationCode":"// Java: pre-flight check of keystore availability before validating SSL context\nFile ks = new File(options.keystore);\nif (!ks.isFile() || !ks.canRead()) throw new IOException(\"Keystore unreadable: \" + options.keystore);\nif (options.keystore_password == null || options.keystore_password.isEmpty()) throw new IOException(\"Empty keystore password\");","typeGuard":null,"tryCatchPattern":"try {\n    SSLFactory.validateSslCerts(options);\n} catch (IOException e) {\n    Throwable cause = e.getCause();\n    logger.error(\"SSL context validation failed: {} (cause: {})\", e.getMessage(), cause, cause);\n    throw new ConfigurationException(\"Fix TLS config: \" + (cause != null ? cause.getMessage() : e.getMessage()), e);\n}","preventionTips":["Run keytool -list against configured keystores after certificate rotation","Verify file permissions for the cassandra user on keystore/truststore paths","Keep passwords in sync in cassandra.yaml and any secret store","Test SSL config changes on a staging node with validateSslCerts before production"],"tags":["ssl","tls","keystore","ioexception","validation"],"backgroundTag":"file-read-failed","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}