{"record":{"id":"d440303da5a81a4f","repo":"apache/cassandra","slug":"setting-require-client-auth-is-incompatible-with","errorCode":null,"errorMessage":"Setting require_client_auth is incompatible with 'rack' and 'dc' internode_encryption values. It is possible for an internode connection to pretend to be in the same rack/dc by spoofing its broadcast address in the handshake and bypass authentication. To ensure that mutual TLS authentication is not bypassed, please set internode_encryption to 'all'. Continuing with insecure configuration.","messagePattern":"Setting require_client_auth is incompatible with 'rack' and 'dc' internode_encryption values\\. It is possible for an internode connection to pretend to be in the same rack/dc by spoofing its broadcast address in the handshake and bypass authentication\\. To ensure that mutual TLS authentication is not bypassed, please set internode_encryption to 'all'\\. Continuing with insecure configuration\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/java/org/apache/cassandra/config/EncryptionOptions.java","lineNumber":950,"sourceCode":"        public ServerEncryptionOptions applyConfig()\n        {\n            return applyConfigInternal();\n        }\n\n        private ServerEncryptionOptions applyConfigInternal()\n        {\n            super.applyConfig();\n\n            isEnabled = this.internode_encryption != InternodeEncryption.none;\n\n            if (this.enabled != null && this.enabled && !isEnabled)\n            {\n                logger.warn(\"Setting server_encryption_options.enabled has no effect, use internode_encryption\");\n            }\n\n            if (getClientAuth() != ClientEncryptionOptions.ClientAuth.NOT_REQUIRED && (internode_encryption == InternodeEncryption.rack || internode_encryption == InternodeEncryption.dc))\n            {\n                logger.warn(\"Setting require_client_auth is incompatible with 'rack' and 'dc' internode_encryption values.\"\n                            + \" It is possible for an internode connection to pretend to be in the same rack/dc by spoofing\"\n                            + \" its broadcast address in the handshake and bypass authentication. To ensure that mutual TLS\"\n                            + \" authentication is not bypassed, please set internode_encryption to 'all'. Continuing with\"\n                            + \" insecure configuration.\");\n            }\n\n            // regardless of the optional flag, if the internode encryption is set to rack or dc\n            // it must be optional so that unencrypted connections within the rack or dc can be established.\n            isOptional = super.isOptional || internode_encryption == InternodeEncryption.rack || internode_encryption == InternodeEncryption.dc;\n\n            return this;\n        }\n\n        public boolean shouldEncrypt(InetAddressAndPort endpoint)\n        {\n            // When a node is started for the very first time, it has no way to determine whether the seed nodes\n            // it makes its initial connections to are in a local or remote datacenter and/or rack. When the node is\n            // in this specific state, Locator will return the constant Location.UNKNOWN for any lookup of a peer's","sourceCodeStart":932,"sourceCodeEnd":968,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/config/EncryptionOptions.java#L932-L968","documentation":"With internode_encryption set to dc or rack, client certificate authentication can be bypassed: a node can spoof its broadcast address to claim it shares the same rack/dc and connect without mutual TLS validation. EncryptionOptions.applyConfig() detects require_client_auth combined with dc/rack modes and warns that the configuration is insecure, continuing anyway.","triggerScenarios":"server_encryption_options has require_client_auth: true (or client-auth set to REQUIRE) while internode_encryption is dc or rack; checked whenever encryption options are applied at startup or on live config reload.","commonSituations":"Operators wanting encryption only across datacenters/racks (common optimization) while also requiring client certs, not realizing dc/rack mode defeats mutual auth; security audits flagging this combination.","solutions":["Set internode_encryption: all so client certificate authentication cannot be bypassed","If dc/rack-only encryption must stay, accept the documented risk after verifying network-level controls inside the dc/rack","Remove require_client_auth if mutual TLS is not actually intended"],"exampleFix":"// before\nserver_encryption_options:\n  internode_encryption: dc\n  require_client_auth: true\n// after\nserver_encryption_options:\n  internode_encryption: all\n  require_client_auth: true","handlingStrategy":"validation","validationCode":"Map seo = cfg.serverEncryptionOptions;\nString mode = (String) seo.getOrDefault(\"internode_encryption\", \"none\");\nboolean clientAuth = Boolean.TRUE.equals(seo.get(\"require_client_auth\"));\nif (clientAuth && (\"dc\".equals(mode) || \"rack\".equals(mode)))\n    throw new IllegalStateException(\"require_client_auth is insecure with internode_encryption=\" + mode + \"; use 'all'\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat require_client_auth + dc/rack as a forbidden combination in config linting","Use internode_encryption: all wherever mutual TLS is required","Include this check in security audits of cassandra.yaml"],"tags":["cassandra","tls","security","mutual-auth"],"backgroundTag":"conflicting-config-options","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}