{"record":{"id":"ce38f8476c56b390","repo":"apache/cassandra","slug":"configuration-must-specify-value-for-either-keysto","errorCode":null,"errorMessage":"Configuration must specify value for either keystore or private_key, not both for PEMBasedSSlContextFactory","messagePattern":"Configuration must specify value for either keystore or private_key, not both for PEMBasedSSlContextFactory","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java","lineNumber":358,"sourceCode":"\n        KeyStore keyStore = KeyStore.getInstance(DEFAULT_TARGET_STORETYPE);\n        keyStore.load(null, null);\n        for (int i = 0; i < certChainArray.length; i++)\n        {\n            keyStore.setCertificateEntry(\"cassandra-ssl-trusted-cert-\" + (i + 1), certChainArray[i]);\n        }\n        return keyStore;\n    }\n\n    /**\n     * Enforces that the configuration specified a sole source of loading private keys - either {@code keystore} (the\n     * actual file must exist) or {@code private_key}, not both.\n     */\n    private void enforceSinglePrivateKeySource()\n    {\n        if (keystoreContext.hasKeystore() && !StringUtils.isEmpty(pemEncodedKeyContext.key))\n        {\n            throw new IllegalArgumentException(\"Configuration must specify value for either keystore or private_key, \" +\n                                               \"not both for PEMBasedSSlContextFactory\");\n        }\n        if (outboundKeystoreContext.hasKeystore() && !StringUtils.isEmpty(pemEncodedOutboundKeyContext.key))\n        {\n            throw new IllegalArgumentException(\"Configuration must specify value for either outbound_keystore or outbound_private_key, \" +\n                                               \"not both for PEMBasedSSlContextFactory\");\n        }\n    }\n\n    /**\n     * Enforces that the configuration specified a sole source of loading trusted certificates - either {@code\n     * truststore} (actual file must exist) or {@code trusted_certificates}, not both.\n     */\n    private void enforceSingleTurstedCertificatesSource()\n    {\n        if (truststoreFileExists() && !StringUtils.isEmpty(pemEncodedTrustCertificates.key))\n        {\n            throw new IllegalArgumentException(\"Configuration must specify value for either truststore or \" +","sourceCodeStart":340,"sourceCodeEnd":376,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java#L340-L376","documentation":"Fires during PEMBasedSslContextFactory initialization when the ssl-options configuration provides both a keystore file and an inline private_key for the inbound identity. The factory supports exactly one private key source per direction, so a mixed configuration is ambiguous and rejected before any keystore is built.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:358 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove either the keystore or the private_key entry from cassandra.yaml so only one inbound private key source remains","If migrating from file-based to PEM-based config, comment out keystore/keystore_password and keep private_key (or vice versa)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}