{"record":{"id":"e8e043153634ebf1","repo":"apache/cassandra","slug":"dropping-unsupported-cipher-suite-from-confi","errorCode":null,"errorMessage":"Dropping unsupported cipher_suite {} from {} configuration","messagePattern":"Dropping unsupported cipher_suite (.+?) from (.+?) configuration","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/java/org/apache/cassandra/security/SSLFactory.java","lineNumber":341,"sourceCode":"            else\n            {\n                newCiphers = new ArrayList<>(supportedCiphers.size());\n            }\n            for (String c : ciphers)\n            {\n                if (c == null)\n                {\n                    break;\n                }\n                if (supportedCiphers.contains(c))\n                {\n                    newCiphers.add(c);\n                }\n                else\n                {\n                    if (settingDescription != null)\n                    {\n                        logger.warn(\"Dropping unsupported cipher_suite {} from {} configuration\",\n                                    c, toLowerCaseLocalized(settingDescription));\n                    }\n                }\n            }\n            if (newCiphers.isEmpty())\n            {\n                throw new IllegalStateException(\"No ciphers left after filtering supported cipher suite\");\n            }\n\n            return newCiphers.toArray(new String[0]);\n        }\n    }\n\n    private static boolean filterOutSSLv2Hello(String string)\n    {\n        return !string.equals(\"SSLv2Hello\");\n    }\n","sourceCodeStart":323,"sourceCodeEnd":359,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/SSLFactory.java#L323-L359","documentation":"SSLFactory.filterCipherSuites filters the configured cipher suite list against the suites the JRE actually supports, dropping unsupported entries with this warning. It prevents IllegalArgumentException later when enabling an unknown TLS cipher, at the cost of silently (well, warningly) weakening the configured cipher list.","triggerScenarios":"cassandra.yaml cipher_suites contains a cipher the installed JDK does not support (wrong name, deprecated algorithm removed by JCE policy, or TLS1.3-only name used with TLS1.2 config).","commonSituations":"Migrating configs between JDK vendors/versions (e.g. cipher removed in newer JDK); typo in cipher name like TLS_ECDHE_RSA_WITH_AES_256_GCM; FIPS-restricted JDK dropping ciphers.","solutions":["Check the warning for the exact dropped cipher name and fix typos.","List supported ciphers for the JDK and keep only supported ones (e.g. via openssl or a small SSLSocketFactory.getSupportedCipherSuites() dump).","Remove obsolete cipher entries from cipher_suites, or install the JCE unlimited policy/JDK that supports them.","Ensure the intersection of configured and supported ciphers is non-empty, otherwise the subsequent 'all ciphers dropped' failure fires."],"exampleFix":"// before (cassandra.yaml)\ncipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA, TLS_AES_128_GCM_SHA256_TYPONAME]\n// after\ncipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA, TLS_AES_128_GCM_SHA256]","handlingStrategy":"validation","validationCode":"// verify each configured cipher is supported by the target JDK\nString[] configured = {...}; // from cassandra.yaml\nSet<String> supported = Set.of(SSLContext.getDefault().getSupportedSSLParameters().getCipherSuites());\njava.util.Arrays.stream(configured)\n    .filter(c -> !supported.contains(c))\n    .forEach(c -> System.err.println(\"Unsupported cipher in config: \" + c));","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate cipher lists per JDK version rather than copying between environments.","Re-validate cipher config after any JDK upgrade.","Keep cipher_suites entries to the intersection of JDK-supported and your security policy."],"tags":["tls","cipher-suites","configuration","ssl"],"backgroundTag":"unsupported-config-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}