{"record":{"id":"a59ec11fd6e65593","repo":"apache/cassandra","slug":"invalid-or-not-supported-certificate","errorCode":null,"errorMessage":"Invalid or not supported certificate","messagePattern":"Invalid or not supported certificate","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java","lineNumber":215,"sourceCode":"        @Override\n        public boolean isComplete()\n        {\n            return true;\n        }\n\n        @Override\n        public AuthenticatedUser getAuthenticatedUser() throws AuthenticationException\n        {\n            if (clientCertificateChain == null || clientCertificateChain.length == 0)\n            {\n                throw new AuthenticationException(\"No certificate present on connection\");\n            }\n\n            if (!certificateValidator.isValidCertificate(clientCertificateChain))\n            {\n                String message = \"Invalid or not supported certificate\";\n                nospamLogger.error(message);\n                throw new AuthenticationException(message);\n            }\n\n            String identity = certificateValidator.identity(clientCertificateChain);\n            if (StringUtils.isEmpty(identity))\n            {\n                String msg = \"Unable to extract client identity from certificate for authentication\";\n                nospamLogger.error(msg);\n                throw new AuthenticationException(msg);\n            }\n            String role = identityCache.get(identity);\n            if (role == null)\n            {\n                String msg = \"Certificate identity '{}' not authorized\";\n                nospamLogger.error(msg, identity);\n                throw new AuthenticationException(MessageFormatter.format(msg, identity).getMessage());\n            }\n\n            // Validates that the certificate validity period does not exceed the maximum certificate configured validity period","sourceCodeStart":197,"sourceCodeEnd":233,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java#L197-L233","documentation":"AuthenticationException from getAuthenticatedUser after the certificate chain was present: certificateValidator.isValidCertificate rejected the chain. The chain is malformed, expired, or otherwise fails the configured validator's checks (the message itself is generic; the validator logs specifics via nospamLogger).","triggerScenarios":"Thrown at src/java/org/apache/cassandra/auth/MutualTlsAuthenticator.java:215 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect server logs for the validator's detailed reason for rejection","Renew or reissue the client certificate if it is expired or signed by an untrusted CA","Ensure the validator's truststore includes the CA that signed the client certificate and the cert type is supported"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}