{"record":{"id":"ea18771cd7baffd0","repo":"apache/cassandra","slug":"full-chain-private-key-is-not-present-in-the-keyst","errorCode":null,"errorMessage":"Full chain/private key is not present in the keystore for certificate {}","messagePattern":"Full chain/private key is not present in the keystore for certificate (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/java/org/apache/cassandra/auth/MutualTlsInternodeAuthenticator.java","lineNumber":234,"sourceCode":"\n    @VisibleForTesting\n    List<String> getIdentitiesFromKeyStore(final String outboundKeyStorePath,\n                                           final String outboundKeyStorePassword,\n                                           final String storeType)\n    {\n        final List<String> allUsers = new ArrayList<>();\n        try (InputStream ksf = Files.newInputStream(Paths.get(outboundKeyStorePath)))\n        {\n            final KeyStore ks = KeyStore.getInstance(storeType);\n            ks.load(ksf, outboundKeyStorePassword.toCharArray());\n            Enumeration<String> enumeration = ks.aliases();\n            while (enumeration.hasMoreElements())\n            {\n                String alias = enumeration.nextElement();\n                Certificate[] chain = ks.getCertificateChain(alias);\n                if (chain == null)\n                {\n                    logger.warn(\"Full chain/private key is not present in the keystore for certificate {}\", alias);\n                    continue;\n                }\n                try\n                {\n                    allUsers.add(certificateValidator.identity(chain));\n                }\n                catch (AuthenticationException e)\n                {\n                    // When identity cannot be extracted, this exception is thrown\n                    // Ignore it, since only few certificates might contain identity\n                }\n            }\n        }\n        catch (Exception e)\n        {\n            logger.error(\"Failed to get identities from outbound_keystore {}\", outboundKeyStorePath, e);\n        }\n        return allUsers;","sourceCodeStart":216,"sourceCodeEnd":252,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/MutualTlsInternodeAuthenticator.java#L216-L252","documentation":"While loading identities from the node's keystore at startup, MutualTlsInternodeAuthenticator found a keystore alias whose entry has no certificate chain — meaning the alias does not hold a private key entry with a full chain. That alias is skipped (not registered as a local identity), so it cannot be used as an authorized identity for mTLS internode auth.","triggerScenarios":"KeyStore.aliases() enumeration returns an alias for which ks.getCertificateChain(alias) returns null — e.g. a trusted-cert entry (imported peer cert) or an alias containing only a public key rather than a PrivateKeyEntry.","commonSituations":"Keystore built with `keytool -importcert` (adds trusted entries) instead of -genkeypair/-importkeystore; merging peer certs into the server keystore; key imported without its chain; corrupted or partially converted PKCS12 files.","solutions":["Remove trusted-certificate-only aliases from the keystore (keytool -delete -alias <alias>) or move them to the truststore.","Ensure each required alias is a PrivateKeyEntry with a complete chain: keytool -list -v -keystore <ks> should show 'PrivateKeyEntry' with chain length > 1 where needed.","Rebuild the keystore with a full chain: openssl pkcs12 -export -in cert.pem -inkey key.pem -certfile chain.pem -out node.p12 and import with keytool -importkeystore.","Verify the identity appears in the authenticator's loaded identities; restart after fixing the keystore."],"exampleFix":"// before (bash): peer cert imported into keystore\nkeytool -importcert -alias peer1 -file peer1.crt -keystore keystore.p12\n// after: delete trusted entry from keystore, put it in truststore\nkeytool -delete -alias peer1 -keystore keystore.p12\nkeytool -importcert -alias peer1 -file peer1.crt -keystore truststore.p12","handlingStrategy":"validation","validationCode":"// Validate keystore entries before deploying (bash)\nkeytool -list -v -keystore keystore.p12 -storepass \"$KS_PASS\" | \\\n  grep -E 'Alias name|Entry type' # every used alias must be PrivateKeyEntry with a chain","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep peer/trusted certificates in the truststore, never the keystore.","Always import keys with their full chain (PKCS12 export including -certfile chain.pem).","Run keytool -list -v as a deployment pre-check for every keystore change.","Verify loaded identities after startup in the logs."],"tags":["tls","keystore","certificate-chain","configuration"],"backgroundTag":"invalid-keystore-entry","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}