{"record":{"id":"ea46a0cf54d0a09f","repo":"apache/cassandra","slug":"failed-to-initialize-ssl","errorCode":null,"errorMessage":"Failed to initialize SSL","messagePattern":"Failed to initialize SSL","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"critical","filePath":"src/java/org/apache/cassandra/config/DatabaseDescriptor.java","lineNumber":1619,"sourceCode":"        if (TEST_JVM_DTEST_DISABLE_SSL.getBoolean())\n            return;\n\n        try\n        {\n            SSLFactory.validateSslContext(\"Internode messaging\", conf.server_encryption_options, REQUIRED, true);\n            SSLFactory.validateSslContext(\"Native transport\", conf.client_encryption_options, conf.client_encryption_options.getClientAuth(), true);\n            // For JMX SSL the validation is pretty much the same as the Native transport\n            SSLFactory.validateSslContext(\"JMX transport\", conf.jmx_server_options.jmx_encryption_options, conf.jmx_server_options.jmx_encryption_options.getClientAuth(), true);\n            SSLFactory.initHotReloading(conf.server_encryption_options, conf.client_encryption_options, false);\n            /*\n            For JMX SSL, the hot reloading of the SSLContext is out of scope for CASSANDRA-18508.\n            Since JMXServerUtil that initializes the JMX Server is used statically, it may require significant\n            effort to change that behavior unlike SSLFactory used for Native transport/Internode messaging.\n             */\n        }\n        catch (IOException e)\n        {\n            throw new ConfigurationException(\"Failed to initialize SSL\", e);\n        }\n    }\n\n    public static void applyCryptoProvider()\n    {\n        if (TEST_SKIP_CRYPTO_PROVIDER_INSTALLATION.getBoolean())\n            return;\n\n        if (conf.crypto_provider == null)\n            conf.crypto_provider = new ParameterizedClass(JREProvider.class.getName(), null);\n\n        // properties beat configuration\n        String classNameFromSystemProperties = CassandraRelevantProperties.CRYPTO_PROVIDER_CLASS_NAME.getString();\n        if (classNameFromSystemProperties != null)\n            conf.crypto_provider.class_name = classNameFromSystemProperties;\n\n        if (conf.crypto_provider.class_name == null)\n            throw new ConfigurationException(\"Failed to initialize crypto provider, class_name cannot be null\");","sourceCodeStart":1601,"sourceCodeEnd":1637,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/config/DatabaseDescriptor.java#L1601-L1637","documentation":"applyEncryptionContext() tries to initialize the SSL context used for the native transport (and JMX-adjacent crypto) via SSLFactory. If loading keystores/truststores throws an IOException (missing or unreadable file, bad password, malformed keystore), it is rethrown as a ConfigurationException('Failed to initialize SSL') and startup aborts.","triggerScenarios":"Calling DatabaseDescriptor.applyEncryptionContext() during startup with client_encryption_options (or related SSL options) enabled and a keystore/truststore path that does not exist, is unreadable, or has an incorrect password.","commonSituations":"TLS enabled in cassandra.yaml but keystore file not deployed to the node; wrong keystore_password; file permissions after a packaging/config-management change; renamed or moved certs during a version upgrade.","solutions":["Verify keystore and truststore paths in client_encryption_options exist and are readable by the cassandra user (`ls -l`, `keytool -list`)","Correct keystore_password/truststore_password in cassandra.yaml","Deploy the missing certificates to every node and restart","If TLS is not intended yet, set enabled: false in client_encryption_options"],"exampleFix":"// cassandra.yaml before\nclient_encryption_options:\n  enabled: true\n  keystore: /etc/cassandra/conf/keystore.jks\n  keystore_password: wrongpass\n// after\nclient_encryption_options:\n  enabled: true\n  keystore: /etc/cassandra/ssl/server.keystore\n  keystore_password: correctPassword","handlingStrategy":"validation","validationCode":"if (conf.client_encryption_options.enabled) {\n    for (String ks : new String[]{conf.client_encryption_options.keystore, conf.client_encryption_options.truststore}) {\n        java.io.File f = new java.io.File(ks);\n        if (!f.canRead()) throw new IllegalStateException(\"Unreadable keystore: \" + ks);\n    }\n}","typeGuard":null,"tryCatchPattern":"try { DatabaseDescriptor.daemonInitialization(); } catch (ConfigurationException e) { logger.error(\"SSL init failed: {}\", e.getMessage(), e); }","preventionTips":["Deploy keystores/truststores with correct ownership before enabling encryption","Test keystore/password with keytool -list on every node","Keep cert paths consistent via config management; avoid hand-edited local paths"],"tags":["cassandra","ssl","configuration","keystore"],"backgroundTag":"file-read-failed","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}