{"record":{"id":"c471cbfb7fc2bb06","repo":"t8y2/dbx","slug":"java-truststore-and-keystore-files-are-not-support","errorCode":null,"errorMessage":"Java truststore and keystore files are not supported; use dbx.cassandra.tls PEM paths","messagePattern":"Java truststore and keystore files are not supported; use dbx\\.cassandra\\.tls PEM paths","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/config_file.go","lineNumber":270,"sourceCode":"\tif value, ok, err := hoconString(parsed, prefix+\"class\"); err != nil {\n\t\treturn err\n\t} else if ok {\n\t\tif !strings.EqualFold(simpleClassName(value), \"DefaultSslEngineFactory\") {\n\t\t\treturn fmt.Errorf(\"unsupported Cassandra SSL engine factory class: %s\", value)\n\t\t}\n\t\tconfig.ssl = true\n\t}\n\tif value, ok, err := hoconBool(parsed, prefix+\"hostname-validation\"); err != nil {\n\t\treturn err\n\t} else if ok {\n\t\tconfig.hostVerification = value\n\t\tconfig.ssl = true\n\t}\n\tfor _, path := range []string{prefix + \"truststore-path\", prefix + \"keystore-path\"} {\n\t\tif value, ok, err := hoconString(parsed, path); err != nil {\n\t\t\treturn err\n\t\t} else if ok && value != \"\" {\n\t\t\treturn fmt.Errorf(\"Java truststore and keystore files are not supported; use dbx.cassandra.tls PEM paths\")\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc applyNativeHOCON(config *cassandraConfig, parsed *hocon.Config) error {\n\tprefix := \"dbx.cassandra.\"\n\tstringMappings := []struct {\n\t\tpath   string\n\t\ttarget *string\n\t}{\n\t\t{\"tls.ca-cert-path\", &config.caCertPath},\n\t\t{\"tls.client-cert-path\", &config.clientCertPath},\n\t\t{\"tls.client-key-path\", &config.clientKeyPath},\n\t\t{\"kerberos.config\", &config.kerberos.configPath},\n\t\t{\"kerberos.jaas-config\", &config.kerberos.jaasConfigPath},\n\t\t{\"kerberos.principal\", &config.kerberos.principal},\n\t\t{\"kerberos.realm\", &config.kerberos.realm},","sourceCodeStart":252,"sourceCodeEnd":288,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/config_file.go#L252-L288","documentation":"The Java driver's SSL engine factory can point to JKS/PKCS12 truststore and keystore files via truststore-path/keystore-path. applyHOCONSSL (config_file.go:270) rejects any non-empty value for either key because the Go driver consumes PEM-encoded certificate files, not Java keystores. TLS must be configured with native dbx.cassandra.tls PEM paths.","triggerScenarios":"A HOCON file contains `advanced.ssl-engine-factory.truststore-path` and/or `keystore-path` set to a .jks/.p12 file path while the Java driver SSL section is being applied.","commonSituations":"Direct port of a JVM Cassandra client config that used /etc/ssl/truststore.jks; enterprise PKI setups that issued Java keystores to developers; mixed JVM/Go fleets sharing one application.conf.","solutions":["Remove truststore-path and keystore-path from the HOCON file.","Convert the Java keystore/truststore to PEM (e.g. `keytool -importkeystore` then `openssl pkcs12 -in out.p12 -nokeys -out ca.pem`, and for keys `openssl pkcs12 -nodes -out client.pem`).","Point the native options dbx.cassandra.tls.ca-cert-path, tls.client-cert-path, and tls.client-key-path at the resulting PEM files.","If the JVM fleet must stay on keystores, keep separate configs for the Java and Go clients."],"exampleFix":"// before (application.conf)\ndatastax-java-driver {\n  advanced.ssl-engine-factory {\n    truststore-path = /etc/ssl/truststore.jks\n    keystore-path = /etc/ssl/keystore.p12\n  }\n}\n// after\n# keys removed; native options instead\n# dbx.cassandra.tls.ca-cert-path = /etc/ssl/ca.pem\n# dbx.cassandra.tls.client-cert-path = /etc/ssl/client-cert.pem\n# dbx.cassandra.tls.client-key-path = /etc/ssl/client-key.pem","handlingStrategy":"validation","validationCode":"func validateNoJavaKeystores(cfg *hocon.Config) error {\n    prefix := \"datastax-java-driver.advanced.ssl-engine-factory.\"\n    for _, k := range []string{\"truststore-path\", \"keystore-path\"} {\n        if cfg.Get(prefix+k) == nil {\n            continue\n        }\n        if v := strings.TrimSpace(cfg.GetString(prefix + k)); v != \"\" {\n            return fmt.Errorf(\"%s is unsupported; use PEM files via dbx.cassandra.tls\", prefix+k)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if err := applyCassandraConfigFile(cfgPath); err != nil {\n    if strings.Contains(err.Error(), \"truststore and keystore files are not supported\") {\n        log.Fatalf(\"convert JKS/PKCS12 stores to PEM and use dbx.cassandra.tls.*-path options\")\n    }\n    return err\n}","preventionTips":["Standardize on PEM certificates for Go clients; keep keystores only for JVM clients.","Add a pre-deploy step converting keystores to PEM (keytool + openssl).","Grep shared configs for 'truststore-path' / 'keystore-path' before rolling out to Go services."],"tags":["cassandra","tls","ssl","keystore","hocon"],"backgroundTag":"unsupported-config-option","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}