{"record":{"id":"a395a948303d0abe","repo":"apache/cassandra","slug":"configuration-must-specify-value-for-either-outbou","errorCode":null,"errorMessage":"Configuration must specify value for either outbound_keystore or outbound_private_key, not both for PEMBasedSSlContextFactory","messagePattern":"Configuration must specify value for either outbound_keystore or outbound_private_key, not both for PEMBasedSSlContextFactory","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java","lineNumber":363,"sourceCode":"            keyStore.setCertificateEntry(\"cassandra-ssl-trusted-cert-\" + (i + 1), certChainArray[i]);\n        }\n        return keyStore;\n    }\n\n    /**\n     * Enforces that the configuration specified a sole source of loading private keys - either {@code keystore} (the\n     * actual file must exist) or {@code private_key}, not both.\n     */\n    private void enforceSinglePrivateKeySource()\n    {\n        if (keystoreContext.hasKeystore() && !StringUtils.isEmpty(pemEncodedKeyContext.key))\n        {\n            throw new IllegalArgumentException(\"Configuration must specify value for either keystore or private_key, \" +\n                                               \"not both for PEMBasedSSlContextFactory\");\n        }\n        if (outboundKeystoreContext.hasKeystore() && !StringUtils.isEmpty(pemEncodedOutboundKeyContext.key))\n        {\n            throw new IllegalArgumentException(\"Configuration must specify value for either outbound_keystore or outbound_private_key, \" +\n                                               \"not both for PEMBasedSSlContextFactory\");\n        }\n    }\n\n    /**\n     * Enforces that the configuration specified a sole source of loading trusted certificates - either {@code\n     * truststore} (actual file must exist) or {@code trusted_certificates}, not both.\n     */\n    private void enforceSingleTurstedCertificatesSource()\n    {\n        if (truststoreFileExists() && !StringUtils.isEmpty(pemEncodedTrustCertificates.key))\n        {\n            throw new IllegalArgumentException(\"Configuration must specify value for either truststore or \" +\n                                               \"trusted_certificates, not both for PEMBasedSSlContextFactory\");\n        }\n    }\n\n    public static class PEMBasedKeyStoreContext","sourceCodeStart":345,"sourceCodeEnd":381,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java#L345-L381","documentation":"Fires during PEMBasedSslContextFactory initialization when both outbound_keystore and outbound_private_key are set. The outbound (secondary) encryption identity may come from only one source; specifying both is an ambiguous configuration rejected by enforceSinglePrivateKeySource.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:363 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure only one of outbound_keystore or outbound_private_key in cassandra.yaml","If outbound identity should mirror the inbound one, omit the outbound_* options entirely so defaults apply"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}