{"record":{"id":"ad1a720aab170ccc","repo":"apache/cassandra","slug":"error-creating-initializing-the-ssl-context","errorCode":null,"errorMessage":"Error creating/initializing the SSL Context","messagePattern":"Error creating/initializing the SSL Context","errorType":"exception","errorClass":"SSLException","httpStatus":null,"severity":"critical","filePath":"src/java/org/apache/cassandra/security/AbstractSslContextFactory.java","lineNumber":178,"sourceCode":"\n    @Override\n    public SSLContext createJSSESslContext(EncryptionOptions.ClientEncryptionOptions.ClientAuth clientAuth) throws SSLException\n    {\n        TrustManager[] trustManagers = null;\n        if (clientAuth != NOT_REQUIRED)\n            trustManagers = buildTrustManagerFactory().getTrustManagers();\n\n        KeyManagerFactory kmf = buildKeyManagerFactory();\n\n        try\n        {\n            SSLContext ctx = SSLContext.getInstance(\"TLS\");\n            ctx.init(kmf.getKeyManagers(), trustManagers, null);\n            return ctx;\n        }\n        catch (Exception e)\n        {\n            throw new SSLException(\"Error creating/initializing the SSL Context\", e);\n        }\n    }\n\n    @Override\n    public SslContext createNettySslContext(boolean verifyPeerCertificate, SocketType socketType,\n                                            CipherSuiteFilter cipherFilter) throws SSLException\n    {\n        return createNettySslContext(verifyPeerCertificate ? REQUIRED : NOT_REQUIRED, socketType, cipherFilter);\n    }\n\n    @Override\n    public SslContext createNettySslContext(EncryptionOptions.ClientEncryptionOptions.ClientAuth clientAuth, SocketType socketType,\n                                            CipherSuiteFilter cipherFilter) throws SSLException\n    {\n        /*\n            There is a case where the netty/openssl combo might not support using KeyManagerFactory. Specifically,\n            I've seen this with the netty-tcnative dynamic openssl implementation. Using the netty-tcnative\n            static-boringssl works fine with KeyManagerFactory. If we want to support all of the netty-tcnative","sourceCodeStart":160,"sourceCodeEnd":196,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/AbstractSslContextFactory.java#L160-L196","documentation":"AbstractSslContextFactory.createJSSESslContext builds a JSSE SSLContext from the configured keystore/truststore. Any exception while loading key/trust managers or initializing the context is wrapped in a SSLException with this message. It signals the TLS configuration (certificates, keys, passwords, algorithm availability) is unusable.","triggerScenarios":"SSLContext.getInstance(\"TLS\") fails (provider missing), or ctx.init() fails because keystore/truststore could not be loaded, wrong password, empty key managers, or invalid key material.","commonSituations":"Misconfigured cassandra.yaml client/server encryption options: wrong keystore path, wrong keystore/truststore password, expired or corrupt certificate, keytool-generated store of unsupported format, or a JVM lacking the required crypto provider (e.g. missing JCE unlimited strength policy on old JDKs).","solutions":["Verify the keystore/truststore file paths and passwords in cassandra.yaml (server_encryption_options / client_encryption_options) are correct and the files exist and are readable by the cassandra user.","Validate the keystore with `keytool -list -v -keystore <file>` to confirm the password and certificate validity.","Check the wrapped cause in the exception chain (getCause) for the concrete failure (NoSuchAlgorithmException, IOException from keystore load, etc.) and fix accordingly.","Ensure the JDK supports the configured ciphers/protocol (install JCE unlimited policy on Java 8, or upgrade the JDK)."],"exampleFix":"// before (cassandra.yaml)\nclient_encryption_options:\n  enabled: true\n  keystore: /wrong/path/.keystore\n  keystore_password: wrongpass\n// after\nclient_encryption_options:\n  enabled: true\n  keystore: /etc/cassandra/.keystore\n  keystore_password: cassandra","handlingStrategy":"validation","validationCode":"for (String ks : new String[]{cfg.keystore, cfg.truststore}) {\n    File f = new File(ks);\n    if (!f.isFile() || !f.canRead()) throw new IllegalStateException(\"Unreadable keystore: \" + ks);\n}\ntry (InputStream in = new FileInputStream(cfg.keystore)) {\n    KeyStore.getInstance(\"JKS\").load(in, cfg.keystorePassword.toCharArray()); // throws if password/format wrong\n}","typeGuard":null,"tryCatchPattern":"try {\n    SslContext ctx = factory.createJSSESslContext(true);\n} catch (SSLException e) {\n    logger.error(\"SSL init failed; check keystore paths/passwords\", e); // inspect e.getCause()\n}","preventionTips":["Validate keystores with keytool -list before deploying","Keep keystore paths/passwords in one reviewed config","Monitor certificate expiry dates","Test TLS config in CI with the same JDK version"],"tags":["ssl","tls","configuration","startup"],"backgroundTag":"invalid-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}