{"record":{"id":"b79bc9666f3f7838","repo":"apache/cassandra","slug":"setting-server-encryption-options-enabled-has-no-e","errorCode":null,"errorMessage":"Setting server_encryption_options.enabled has no effect, use internode_encryption","messagePattern":"Setting server_encryption_options\\.enabled has no effect, use internode_encryption","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/java/org/apache/cassandra/config/EncryptionOptions.java","lineNumber":945,"sourceCode":"            putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.OUTBOUND_KEYSTORE_PASSWORD, this.outbound_keystore_password);\n            putSslContextFactoryParameter(sslContextFactoryParameters, ConfigKey.OUTBOUND_KEYSTORE_PASSWORD_FILE, this.outbound_keystore_password_file);\n        }\n\n        @Override\n        public ServerEncryptionOptions applyConfig()\n        {\n            return applyConfigInternal();\n        }\n\n        private ServerEncryptionOptions applyConfigInternal()\n        {\n            super.applyConfig();\n\n            isEnabled = this.internode_encryption != InternodeEncryption.none;\n\n            if (this.enabled != null && this.enabled && !isEnabled)\n            {\n                logger.warn(\"Setting server_encryption_options.enabled has no effect, use internode_encryption\");\n            }\n\n            if (getClientAuth() != ClientEncryptionOptions.ClientAuth.NOT_REQUIRED && (internode_encryption == InternodeEncryption.rack || internode_encryption == InternodeEncryption.dc))\n            {\n                logger.warn(\"Setting require_client_auth is incompatible with 'rack' and 'dc' internode_encryption values.\"\n                            + \" It is possible for an internode connection to pretend to be in the same rack/dc by spoofing\"\n                            + \" its broadcast address in the handshake and bypass authentication. To ensure that mutual TLS\"\n                            + \" authentication is not bypassed, please set internode_encryption to 'all'. Continuing with\"\n                            + \" insecure configuration.\");\n            }\n\n            // regardless of the optional flag, if the internode encryption is set to rack or dc\n            // it must be optional so that unencrypted connections within the rack or dc can be established.\n            isOptional = super.isOptional || internode_encryption == InternodeEncryption.rack || internode_encryption == InternodeEncryption.dc;\n\n            return this;\n        }\n","sourceCodeStart":927,"sourceCodeEnd":963,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/config/EncryptionOptions.java#L927-L963","documentation":"In modern Cassandra server_encryption_options, whether encryption is on is determined solely by internode_encryption (none/dc/rack/all); the nested enabled flag is ignored. If a user sets enabled: true while internode_encryption is none, EncryptionOptions.applyConfig() logs this warning so the operator knows encryption is NOT active despite the flag.","triggerScenarios":"server_encryption_options in cassandra.yaml contains enabled: true while internode_encryption is none (or absent); also thrown on runtime config updates reloading the yaml. Setting enabled: false or leaving internode_encryption != none does not warn.","commonSituations":"Migrating older configs where enabled existed; operators assuming enabled: true turns on internode TLS after a version change; automated config generation that emits both keys.","solutions":["Set internode_encryption: all (or dc/rack) in server_encryption_options to actually enable encryption","Remove the obsolete enabled key from server_encryption_options to avoid confusion","Restart or reload config and verify with nodetool gossipinfo / logs that internode TLS is active"],"exampleFix":"// before\nserver_encryption_options:\n  enabled: true\n  internode_encryption: none\n// after\nserver_encryption_options:\n  internode_encryption: all","handlingStrategy":"validation","validationCode":"Map seo = cfg.serverEncryptionOptions;\nif (Boolean.TRUE.equals(seo.get(\"enabled\")) && \"none\".equals(seo.getOrDefault(\"internode_encryption\", \"none\")))\n    throw new IllegalStateException(\"server_encryption_options.enabled is ignored; set internode_encryption\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Drop the deprecated enabled key from all server_encryption_options blocks","Use internode_encryption as the single source of truth","Verify active TLS with nodetool gossipinfo after config changes"],"tags":["cassandra","tls","encryption","configuration"],"backgroundTag":"deprecated-api-usage","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}