{"record":{"id":"f94fc0e8c91b5418","repo":"apache/cassandra","slug":"could-not-create-ssl-context","errorCode":null,"errorMessage":"Could not create SSL Context.","messagePattern":"Could not create SSL Context\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"tools/sstableloader/src/org/apache/cassandra/tools/BulkLoader.java","lineNumber":271,"sourceCode":"        }\n    }\n\n    private static SSLOptions buildSSLOptions(EncryptionOptions clientEncryptionOptions)\n    {\n\n        if (!clientEncryptionOptions.getEnabled())\n        {\n            return null;\n        }\n\n        SSLContext sslContext;\n        try\n        {\n            sslContext = SSLFactory.createSSLContext(clientEncryptionOptions, REQUIRED);\n        }\n        catch (IOException e)\n        {\n            throw new RuntimeException(\"Could not create SSL Context.\", e);\n        }\n\n        // Temporarily override newSSLEngine to set accepted protocols until it is added to\n        // RemoteEndpointAwareJdkSSLOptions.  See CASSANDRA-13325 and CASSANDRA-16362.\n        RemoteEndpointAwareJdkSSLOptions sslOptions = new RemoteEndpointAwareJdkSSLOptions(sslContext, clientEncryptionOptions.cipherSuitesArray())\n        {\n            @Override\n            protected SSLEngine newSSLEngine(SocketChannel channel, InetSocketAddress remoteEndpoint)\n            {\n                SSLEngine engine = super.newSSLEngine(channel, remoteEndpoint);\n\n                String[] acceptedProtocols = clientEncryptionOptions.acceptedProtocolsArray();\n                if (acceptedProtocols != null && acceptedProtocols.length > 0)\n                    engine.setEnabledProtocols(acceptedProtocols);\n\n                return engine;\n            }\n        };","sourceCodeStart":253,"sourceCodeEnd":289,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/tools/sstableloader/src/org/apache/cassandra/tools/BulkLoader.java#L253-L289","documentation":"BulkLoader.buildSSLOptions() wraps any IOException from SSLFactory.createSSLContext(clientEncryptionOptions, REQUIRED) in a RuntimeException 'Could not create SSL Context.'. It means the client TLS material (keystore/truststore files, passwords, algorithms) could not be loaded while building the native-protocol SSL engine. See tools/sstableloader/src/org/apache/cassandra/tools/BulkLoader.java:271.","triggerScenarios":"Running sstableloader with encrypted client connections where the config's client_encryption_options point to a missing/unreadable keystore or truststore, wrong passwords, or an unavailable TLS algorithm/provider.","commonSituations":"Copying server cassandra.yaml to the loader host without the keystore files; typo'd keystore path or password; cluster certs missing from the truststore; Java version lacking the configured algorithm.","solutions":["Verify keystore/truststore paths exist and are readable by the loader process","Check keystore/truststore passwords (test with `keytool -list`)","Confirm the truststore contains the cluster's certificate chain","If encryption isn't required for this load, run without SSL/client encryption"],"exampleFix":"// before\nthrow new RuntimeException(\"Could not create SSL Context.\", e);\n// after\nthrow new RuntimeException(\"Could not create SSL Context (check keystore/truststore paths and passwords): \" + e.getMessage(), e);","handlingStrategy":"validation","validationCode":"// verify TLS material before running sstableloader\nString ksPath = clientEncryptionOptions.keystore;\nSystem.out.println(new File(ksPath).canRead() ? \"keystore ok\" : \"keystore missing\");\n// verify passwords + trust chain:\n// keytool -list -keystore <ksPath> -storepass <pw>\n// keytool -list -keystore <tsPath> -storepass <tsPw>","typeGuard":null,"tryCatchPattern":"try {\n    loader.load(options);\n} catch (RuntimeException e) {\n    if (e.getMessage() != null && e.getMessage().contains(\"Could not create SSL Context\")) {\n        throw new IllegalStateException(\"Check client_encryption_options keystore/truststore\", e);\n    }\n    throw e;\n}","preventionTips":["Copy keystore/truststore files alongside any cassandra.yaml used by sstableloader","Validate keystores with keytool before running loads","Keep the truststore updated with the cluster's certificate chain","If TLS isn't needed for the bulk load, run without SSL"],"tags":["ssl","tls","sstableloader"],"backgroundTag":"missing-credentials","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}