{"record":{"id":"f10c141168beb3b3","repo":"t8y2/dbx","slug":"unsupported-cassandra-ssl-engine-factory-class-s","errorCode":null,"errorMessage":"unsupported Cassandra SSL engine factory class: %s","messagePattern":"unsupported Cassandra SSL engine factory class: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/config_file.go","lineNumber":256,"sourceCode":"\t\tconfig.kerberos.useKeytab = value\n\t\tconfig.kerberos.useKeytabSet = true\n\t}\n\tif value, ok, err := firstHOCONBool(parsed, loginPrefix+\"useTicketCache\", loginPrefix+\"use-ticket-cache\"); err != nil {\n\t\treturn err\n\t} else if ok {\n\t\tconfig.kerberos.useTicketCache = value\n\t\tconfig.kerberos.useTicketCacheSet = true\n\t}\n\treturn nil\n}\n\nfunc applyHOCONSSL(config *cassandraConfig, parsed *hocon.Config) error {\n\tprefix := javaDriverConfigPrefix + \"advanced.ssl-engine-factory.\"\n\tif value, ok, err := hoconString(parsed, prefix+\"class\"); err != nil {\n\t\treturn err\n\t} else if ok {\n\t\tif !strings.EqualFold(simpleClassName(value), \"DefaultSslEngineFactory\") {\n\t\t\treturn fmt.Errorf(\"unsupported Cassandra SSL engine factory class: %s\", value)\n\t\t}\n\t\tconfig.ssl = true\n\t}\n\tif value, ok, err := hoconBool(parsed, prefix+\"hostname-validation\"); err != nil {\n\t\treturn err\n\t} else if ok {\n\t\tconfig.hostVerification = value\n\t\tconfig.ssl = true\n\t}\n\tfor _, path := range []string{prefix + \"truststore-path\", prefix + \"keystore-path\"} {\n\t\tif value, ok, err := hoconString(parsed, path); err != nil {\n\t\t\treturn err\n\t\t} else if ok && value != \"\" {\n\t\t\treturn fmt.Errorf(\"Java truststore and keystore files are not supported; use dbx.cassandra.tls PEM paths\")\n\t\t}\n\t}\n\treturn nil\n}","sourceCodeStart":238,"sourceCodeEnd":274,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/config_file.go#L238-L274","documentation":"applyHOCONSSL (config_file.go:256) accepts only the Java driver's DefaultSslEngineFactory for `advanced.ssl-engine-factory.class` (case-insensitive simple class name). Any other SSL engine factory, such as the common Netty-based `ReceivedConfigSslEngineFactory` or a custom one, is rejected because the Go driver cannot use JVM SSL engines; native dbx.cassandra.tls settings are the supported path.","triggerScenarios":"A HOCON file sets `datastax-java-driver.advanced.ssl-engine-factory.class` to anything other than DefaultSslEngineFactory, e.g. `com.datastax.oss.driver.internal.core.ssl.NettySslEngineFactory` or a custom class.","commonSituations":"Configs migrated from DSE Java driver 1.x that used CommonNameSslEngineFactory or a hostname-verification custom factory; enterprise setups with a bespoke SSL engine for client certificates.","solutions":["Set `advanced.ssl-engine-factory.class` to DefaultSslEngineFactory in the HOCON file.","If you need custom TLS material (client certs, custom CA), remove the Java-driver SSL engine config and use the native `dbx.cassandra.tls.ca-cert-path`, `client-cert-path`, and `client-key-path` options instead.","Configure hostname verification via the native `dbx.cassandra.tls.hostname-verification` key rather than a custom engine factory.","If a custom engine factory was essential, replicate its behavior (e.g. SNI/hostname rules) at the TLS-terminating layer or in the Go TLS config options exposed by the library."],"exampleFix":"// before (application.conf)\ndatastax-java-driver {\n  advanced.ssl-engine-factory.class = com.datastax.oss.driver.internal.core.ssl.NettySslEngineFactory\n}\n// after\ndatastax-java-driver {\n  advanced.ssl-engine-factory.class = com.datastax.oss.driver.internal.core.ssl.DefaultSslEngineFactory\n}","handlingStrategy":"validation","validationCode":"func validateSslEngineFactory(cfg *hocon.Config) error {\n    const key = \"datastax-java-driver.advanced.ssl-engine-factory.class\"\n    if cfg.Get(key) == nil {\n        return nil\n    }\n    v := cfg.GetString(key)\n    simple := v[strings.LastIndex(v, \".\")+1:]\n    if !strings.EqualFold(simple, \"DefaultSslEngineFactory\") {\n        return fmt.Errorf(\"unsupported ssl-engine-factory: %s\", v)\n    }\n    return nil\n}","typeGuard":"func isDefaultSslEngineFactory(class string) bool {\n    return strings.EqualFold(class[strings.LastIndex(class, \".\")+1:], \"DefaultSslEngineFactory\")\n}","tryCatchPattern":"if err := applyCassandraConfigFile(cfgPath); err != nil {\n    if strings.Contains(err.Error(), \"unsupported Cassandra SSL engine factory\") {\n        log.Fatalf(\"only DefaultSslEngineFactory is supported; move custom TLS settings to dbx.cassandra.tls\")\n    }\n    return err\n}","preventionTips":["Configure TLS through native dbx.cassandra.tls keys, not Java engine factories.","Audit migrated configs for NettySslEngineFactory/CommonNameSslEngineFactory before use.","Add config CI that runs the loader against shipped application.conf files."],"tags":["cassandra","tls","ssl","hocon","unsupported-feature"],"backgroundTag":"unsupported-config-option","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}