{"record":{"id":"f0f86d706346e17b","repo":"apache/cassandra","slug":"configuration-must-specify-value-for-either-trusts","errorCode":null,"errorMessage":"Configuration must specify value for either truststore or trusted_certificates, not both for PEMBasedSSlContextFactory","messagePattern":"Configuration must specify value for either truststore or trusted_certificates, not both for PEMBasedSSlContextFactory","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java","lineNumber":376,"sourceCode":"            throw new IllegalArgumentException(\"Configuration must specify value for either keystore or private_key, \" +\n                                               \"not both for PEMBasedSSlContextFactory\");\n        }\n        if (outboundKeystoreContext.hasKeystore() && !StringUtils.isEmpty(pemEncodedOutboundKeyContext.key))\n        {\n            throw new IllegalArgumentException(\"Configuration must specify value for either outbound_keystore or outbound_private_key, \" +\n                                               \"not both for PEMBasedSSlContextFactory\");\n        }\n    }\n\n    /**\n     * Enforces that the configuration specified a sole source of loading trusted certificates - either {@code\n     * truststore} (actual file must exist) or {@code trusted_certificates}, not both.\n     */\n    private void enforceSingleTurstedCertificatesSource()\n    {\n        if (truststoreFileExists() && !StringUtils.isEmpty(pemEncodedTrustCertificates.key))\n        {\n            throw new IllegalArgumentException(\"Configuration must specify value for either truststore or \" +\n                                               \"trusted_certificates, not both for PEMBasedSSlContextFactory\");\n        }\n    }\n\n    public static class PEMBasedKeyStoreContext\n    {\n        public String key;\n        public final String password;\n        public final boolean maybeFilebasedKey;\n        public final FileBasedStoreContext filebasedKeystoreContext;\n\n        public PEMBasedKeyStoreContext(final String encodedKey, final String getEncodedKeyPassword,\n                                       final boolean maybeFilebasedKey, final FileBasedStoreContext filebasedKeystoreContext)\n        {\n            this.key = encodedKey;\n            this.password = getEncodedKeyPassword;\n            this.maybeFilebasedKey = maybeFilebasedKey;\n            this.filebasedKeystoreContext = filebasedKeystoreContext;","sourceCodeStart":358,"sourceCodeEnd":394,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java#L358-L394","documentation":"Fires during PEMBasedSslContextFactory initialization when both a truststore file and inline trusted_certificates are configured. The factory accepts only one source of trusted certificates, so the mixed setup is rejected before building the trust manager.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/security/PEMBasedSslContextFactory.java:376 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Keep either truststore (with truststore_password) or trusted_certificates, not both","If using PEM certificates inline, remove the truststore path entries from the ssl context options"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}