{"record":{"id":"a388a085ec16c0e4","repo":"apache/cassandra","slug":"configured-node-identity-is-not-matching-identity","errorCode":null,"errorMessage":"Configured node identity is not matching identity extractedfrom the keystore","messagePattern":"Configured node identity is not matching identity extractedfrom the keystore","errorType":"exception","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/MutualTlsInternodeAuthenticator.java","lineNumber":131,"sourceCode":"            // If trusted_peer_identities identities is configured in cassandra.yaml trust only those identities\n            trustedIdentities = Arrays.stream(parameters.get(TRUSTED_PEER_IDENTITIES).split(\",\"))\n                                      .collect(Collectors.toList());\n        }\n        else\n        {\n            // Otherwise, trust the identities extracted from outbound keystore which is the identity that the node uses\n            // for making outbound connections.\n            trustedIdentities = getIdentitiesFromKeyStore(config.server_encryption_options.outbound_keystore,\n                                                          config.server_encryption_options.outbound_keystore_password,\n                                                          config.server_encryption_options.store_type);\n            // optionally, if node_identity is configured in the yaml, validate the identity extracted from outbound\n            // keystore to avoid any configuration errors\n            if (parameters.containsKey(NODE_IDENTITY))\n            {\n                String nodeIdentity = parameters.get(NODE_IDENTITY);\n                if (!trustedIdentities.contains(nodeIdentity))\n                {\n                    throw new ConfigurationException(\"Configured node identity is not matching identity extracted\" +\n                                                     \"from the keystore\");\n                }\n                trustedIdentities.retainAll(Collections.singleton(nodeIdentity));\n            }\n        }\n\n        if (!trustedIdentities.isEmpty())\n        {\n            logger.info(\"Initializing internode authenticator with identities {}\", trustedIdentities);\n        }\n        else\n        {\n            String message = String.format(\"No identity was extracted from the outbound keystore '%s'\", config.server_encryption_options.outbound_keystore);\n            logger.info(message);\n            throw new ConfigurationException(message);\n        }\n\n        certificateValidityPeriodValidator = new MutualTlsCertificateValidityPeriodValidator(config.server_encryption_options.max_certificate_validity_period);","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/MutualTlsInternodeAuthenticator.java#L113-L149","documentation":"Thrown as a ConfigurationException during MutualTlsInternodeAuthenticator initialization when the node_identity configured under server_encryption_options.outbound_keystore_path/identity is not present among the identities parsed from the outbound keystore. Cassandra validates the configured identity against the keystore at startup to catch configuration mistakes before any internode traffic is accepted.","triggerScenarios":"Config server_encryption_options.outbound_keystore_path with a node_identity (NODE_IDENTITY parameter) whose value does not exactly match any certificate identity (e.g. SAN/CN) extracted from the outbound keystore; typos, whitespace, or stale identity after certificate rotation.","commonSituations":"Copying cassandra.yaml between clusters; rotating certs and forgetting to update node_identity; mismatched case/format between the yaml value and the certificate's identity field.","solutions":["Open the keystore and extract the actual identity (CN/SAN) of the outbound certificate","Set node_identity in server_encryption_options to exactly match that extracted identity","Re-run node startup; check the log line 'Initializing internode authenticator with identities' for the accepted values","If the keystore was rotated, regenerate the keystore so it contains the intended identity"],"exampleFix":"// before (cassandra.yaml)\nserver_encryption_options:\n  outbound_keystore: /etc/cassandra/outbound.p12\n  node_identity: node-old.cluster.example.com\n// after\nserver_encryption_options:\n  outbound_keystore: /etc/cassandra/outbound.p12\n  node_identity: node1.cluster.example.com","handlingStrategy":"validation","validationCode":"// before startup: confirm configured identity exists in keystore\nkeytool -list -v -keystore /etc/cassandra/outbound.p12 | grep -i 'CN=\\|SAN'\n# compare output to server_encryption_options.node_identity in cassandra.yaml","typeGuard":null,"tryCatchPattern":"// catch during startup wiring\ntry { authenticator.validateConfiguration(); }\ncatch (ConfigurationException e) { LOG.error(\"mTLS identity misconfigured: \" + e.getMessage()); throw e; }","preventionTips":["Generate node_identity from the certificate's CN/SAN programmatically rather than hand-editing yaml","Log keystore identities at startup and diff against configuration","Treat node_identity as part of the certificate rotation checklist"],"tags":["tls","mtls","configuration","internode-authentication"],"backgroundTag":"invalid-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}