{"record":{"id":"9a5d85f25d0af7e7","repo":"apache/cassandra","slug":"failed-to-reload-ssl-certificates-please-check-th","errorCode":null,"errorMessage":"Failed to reload SSL certificates. Please check the SSL certificates","messagePattern":"Failed to reload SSL certificates\\. Please check the SSL certificates","errorType":"console","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/tools/nodetool/ReloadSslCertificates.java","lineNumber":38,"sourceCode":"import java.io.IOException;\n\nimport org.apache.cassandra.tools.NodeProbe;\n\nimport picocli.CommandLine.Command;\n\n@Command(name = \"reloadssl\", description = \"Signals Cassandra to reload SSL certificates\")\npublic class ReloadSslCertificates extends AbstractCommand\n{\n    @Override\n    public void execute(NodeProbe probe)\n    {\n        try\n        {\n            probe.reloadSslCerts();\n        }\n        catch (IOException e)\n        {\n            throw new RuntimeException(\"Failed to reload SSL certificates. Please check the SSL certificates\", e);\n        }\n    }\n}\n","sourceCodeStart":20,"sourceCodeEnd":42,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/tools/nodetool/ReloadSslCertificates.java#L20-L42","documentation":"Nodetool ReloadSslCertificates calls probe.reloadSslCerts() over JMX to hot-reload the node's SSL keystores/truststores. Any IOException from that remote call is wrapped in this RuntimeException telling the operator to check the certificates.","triggerScenarios":"`nodetool reloadssl` when the JMX call fails: node unreachable, or the node-side reload itself reported an IO error (unreadable/malformed keystore, wrong password file path).","commonSituations":"Rotating certificates with a typo'd keystore path in cassandra.yaml; keystore password mismatch; stale JMX connection; files replaced with wrong permissions before reload.","solutions":["Check the wrapped cause and node logs for the underlying SSL error","Validate keystore/truststore paths and passwords in cassandra.yaml","Ensure certificate files are readable by the cassandra user","Fix config and retry `nodetool reloadssl`, or restart the node if reload keeps failing"],"exampleFix":"// before\nserver_encryption_options: keystore: /missing/path/keystore.jks\n// after\nserver_encryption_options: keystore: /etc/cassandra/ssl/keystore.jks","handlingStrategy":"validation","validationCode":"test -r \"$KEYSTORE\" && openssl x509 -in \"$CERT\" -noout >/dev/null && echo \"cert files OK\"","typeGuard":null,"tryCatchPattern":"try { probe.reloadSslCerts(); } catch (RuntimeException e) { log.error(\"reloadssl failed; check keystore paths/passwords: {}\", e.getCause(), e); throw e; }","preventionTips":["Validate keystore/truststore paths and permissions before rotation","Keep keystore passwords in sync with config","Test reloads on a staging node first"],"tags":["nodetool","ssl","jmx","certificate-reload"],"backgroundTag":"http-request-failed","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}