{"record":{"id":"fa0f9ef67fcb7169","repo":"apache/cassandra","slug":"peer-attempted-to-establish-an-unencrypted-conn","errorCode":null,"errorMessage":"peer {} attempted to establish an unencrypted connection (broadcast address {})","messagePattern":"peer (.+?) attempted to establish an unencrypted connection \\(broadcast address (.+?)\\)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/net/InboundConnectionInitiator.java","lineNumber":328,"sourceCode":"\n        @Override\n        protected void decode(ChannelHandlerContext ctx, ByteBuf in, List<Object> out) throws Exception\n        {\n            if (initiate == null) initiate(ctx, in);\n            else throw new IllegalStateException(\"Should no longer be on pipeline\");\n        }\n\n        void initiate(ChannelHandlerContext ctx, ByteBuf in) throws IOException\n        {\n            initiate = HandshakeProtocol.Initiate.maybeDecode(in);\n            if (initiate == null)\n                return;\n\n            logger.trace(\"Received handshake initiation message from peer {}, message = {}\", ctx.channel().remoteAddress(), initiate);\n\n            if (isEncryptionRequired(initiate.from) && !isChannelEncrypted(ctx))\n            {\n                logger.warn(\"peer {} attempted to establish an unencrypted connection (broadcast address {})\",\n                            ctx.channel().remoteAddress(), initiate.from);\n                failHandshake(ctx);\n                return;\n            }\n\n            assert initiate.acceptVersions != null;\n            if (logger.isTraceEnabled())\n                logger.trace(\"Connection version {} (min {}) from {}\", initiate.acceptVersions.max, initiate.acceptVersions.min, initiate.from);\n\n            final AcceptVersions accept;\n\n            if (initiate.type.isStreaming())\n                accept = settings.acceptStreaming;\n            else\n                accept = settings.acceptMessaging;\n\n            int useMessagingVersion = max(accept.min, min(accept.max, initiate.acceptVersions.max));\n            ByteBuf flush = new HandshakeProtocol.Accept(useMessagingVersion, accept.max).encode(ctx.alloc());","sourceCodeStart":310,"sourceCodeEnd":346,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/net/InboundConnectionInitiator.java#L310-L346","documentation":"InboundConnectionInitiator.initiate rejected a peer whose handshake initiation was not a valid TLS/SSL record while the socket requires encryption (server_encryption_options). The connection attempt is refused; logged with the peer and its broadcast address to identify misconfigured clients or wrong-port connections.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/net/InboundConnectionInitiator.java:328 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Enable TLS on the connecting client/peer, or adjust server_encryption_options (e.g. optional mode) if unencrypted peers are expected.","Verify the peer connects on the intended encrypted port."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}