{"record":{"id":"d6c44a8715e7a781","repo":"apache/cassandra","slug":"error-finding-supported-tls-protocols","errorCode":null,"errorMessage":"Error finding supported TLS Protocols","messagePattern":"Error finding supported TLS Protocols","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/SSLFactory.java","lineNumber":122,"sourceCode":"    private static boolean isHotReloadingInitialized = false;\n\n    /** Provides the list of protocols that would have been supported if \"TLS\" was selected as the\n     * protocol before the change for CASSANDRA-13325 that expects explicit protocol versions.\n     * @return list of enabled protocol names\n     */\n    public static List<String> tlsInstanceProtocolSubstitution()\n    {\n        try\n        {\n            SSLContext ctx = SSLContext.getInstance(\"TLS\");\n            ctx.init(null, null, null);\n            SSLParameters params = ctx.getDefaultSSLParameters();\n            String[] protocols = params.getProtocols();\n            return Arrays.asList(protocols);\n        }\n        catch (Exception e)\n        {\n            throw new RuntimeException(\"Error finding supported TLS Protocols\", e);\n        }\n    }\n\n    /**\n     * Create a JSSE {@link SSLContext}.\n     */\n    public static SSLContext createSSLContext(EncryptionOptions options, EncryptionOptions.ClientEncryptionOptions.ClientAuth clientAuth) throws IOException\n    {\n        return options.sslContextFactoryInstance.createJSSESslContext(clientAuth);\n    }\n\n    /**\n     * get a netty {@link SslContext} instance\n     */\n    public static SslContext getOrCreateSslContext(EncryptionOptions options, EncryptionOptions.ClientEncryptionOptions.ClientAuth clientAuth,\n                                                   SocketType socketType,\n                                                   String contextDescription) throws IOException\n    {","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/SSLFactory.java#L104-L140","documentation":"tlsInstanceProtocolSubstitution builds a default JVM 'TLS' SSLContext and reads its default SSLParameters to enumerate the supported TLS protocol names (used to emulate the pre-CASSANDRA-13325 'TLS' wildcard). If obtaining the SSLContext, initializing it, or reading its parameters throws — typically a JSSE provider/config problem — it is rethrown as this RuntimeException.","triggerScenarios":"Calling SSLFactory.tlsInstanceProtocolSubstitution() when SSLContext.getInstance(\"TLS\") throws NoSuchProviderException/NoSuchAlgorithmException (no JSSE provider), ctx.init fails (e.g. no default KeyManager/TrustManager can be constructed due to a broken keystore, missing java.security config, or a failing security provider), or params.getProtocols() errors.","commonSituations":"A JVM with a customized or broken java.security file removing the SunJSSE provider; a misconfigured javax.net.ssl default keystore/truststore system property causing init to throw; running on a stripped JRE lacking the crypto providers; FIPS-mode environments where 'TLS' is not available under that name or provider initialization fails.","solutions":["Inspect the wrapped cause exception (RuntimeException's cause) — it names the actual provider/keystore problem","Check the JVM's java.security file has not removed the SunJSSE provider or disabled the TLS algorithms (jdk.tls.disabledAlgorithms)","Verify javax.net.ssl.keyStore / trustStore system properties point to valid, password-correct keystores if set","Run on a full JDK/JRE with JSSE available rather than a stripped runtime; ensure the JVM security policy permits TLS","If in a FIPS environment, confirm the FIPS provider is correctly configured and provides a 'TLS' SSLContext"],"exampleFix":"// before: stripped JRE / removed provider breaks default TLS context\nSSLContext ctx = SSLContext.getInstance(\"TLS\"); // NoSuchAlgorithmException\n// after: run on a full JDK with SunJSSE, or specify an explicitly available provider/protocol set\nSSLContext ctx = SSLContext.getInstance(\"TLSv1.2\", \"SunJSSE\");","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"List<String> protocols;\ntry {\n    protocols = SSLFactory.tlsInstanceProtocolSubstitution();\n} catch (RuntimeException e) {\n    logger.error(\"Could not enumerate default TLS protocols from the JSSE provider; check java.security config and keystore system properties\", e);\n    protocols = Arrays.asList(\"TLSv1.2\", \"TLSv1.3\"); // sane fallback\n}","preventionTips":["Do not strip SunJSSE or related providers from the JVM's java.security file","Keep javax.net.ssl.keyStore/trustStore system properties valid when set, or unset them so defaults are used","Run Cassandra on a full JDK, not a stripped JRE, when TLS is enabled","In FIPS environments, verify the configured security provider exposes a usable TLS SSLContext before startup"],"tags":["tls","ssl","jvm","jsse","protocols"],"backgroundTag":"unsupported-operation","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}