t8y2/dbx · error

custom Cassandra sslenginefactory is not supported by the na

Error message

custom Cassandra sslenginefactory is not supported by the native agent: %s

What it means

The 'sslenginefactory' URL parameter only supports the default SSL engine (class name DefaultSslEngineFactory, case-insensitive). Any custom SslEngineFactory class name from the Java driver world cannot be honored by the native agent, so the library rejects the DSN outright rather than silently dropping custom TLS behavior.

Source

Thrown at agents/drivers/cassandra-go/config.go:283

			}
			config.reconnectionPolicy = policy
			config.reconnectionBaseDelay = baseDelay
			config.reconnectionMaxDelay = maxDelay
		case "disableinitialhostlookup":
			disabled, err := strconv.ParseBool(value)
			if err != nil {
				return fmt.Errorf("invalid disableinitialhostlookup option: %w", err)
			}
			config.disableInitialHostLookup = disabled
		case "loadbalancing":
			policy, err := normalizeLoadBalancingPolicy(value)
			if err != nil {
				return err
			}
			config.loadBalancingPolicy = policy
		case "sslenginefactory":
			if value != "" && !strings.EqualFold(simpleClassName(value), "DefaultSslEngineFactory") {
				return fmt.Errorf("custom Cassandra sslenginefactory is not supported by the native agent: %s", value)
			}
			config.ssl = true
		case "usekrb5":
			enabled, err := strconv.ParseBool(value)
			if err != nil {
				return fmt.Errorf("invalid usekrb5 option: %w", err)
			}
			config.kerberos.enabled = enabled
		case "secureconnectbundle":
			config.secureConnectBundle = value
		case "configfile":
			config.configFile = value
		case "kerberosconfig", "kerberosconfigpath", "krb5config", "krb5conf":
			config.kerberos.configPath = value
		case "jaasconfig", "jaasconfigpath":
			config.kerberos.jaasConfigPath = value
		case "kerberosprincipal", "krb5principal":
			config.kerberos.principal = value

View on GitHub (pinned to c0390bff16)

Solutions

1. Remove the sslenginefactory parameter and rely on the default engine by just setting ssl=true or sslenginefactory=DefaultSslEngineFactory
2. Configure TLS via the agent's supported options (cert files, secure connect bundle) instead of a custom factory
3. If custom TLS logic is required, terminate/customize TLS outside the connection URL or at the proxy layer

Example fix

// before
cassandra://127.0.0.1/myks?sslenginefactory=com.acme.CustomSslEngineFactory
// after
cassandra://127.0.0.1/myks?ssl=true

if v := q.Get("sslenginefactory"); v != "" && !strings.EqualFold(simpleClassName(v), "DefaultSslEngineFactory") {
	// strip or replace the param before handing the DSN to the agent
}

if err := parseCassandraConfig(dsn); err != nil {
	if strings.Contains(err.Error(), "sslenginefactory is not supported") {
		return parseCassandraConfig(stripParam(dsn, "sslenginefactory"))
	}
	return err
}

When it happens

Trigger: DSN contains sslenginefactory=<ClassName> where the simple class name is anything other than DefaultSslEngineFactory and the value is non-empty, e.g. sslenginefactory=com.example.MySslEngineFactory.

Common situations: Porting an existing Java Cassandra JDBC/driver URL to the native agent; enterprise setups with custom TLS certificate loaders configured via sslenginefactory; templates that carry over all Java driver options.

Related errors

• invalid host verification option: %w
• unsupported Cassandra URL parameter: %s
• unsupported Cassandra SSL engine factory class: %s
• invalid requesttimeout: %w
• invalid connecttimeout: %w

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/2fc4fc0be1209fde. Report an issue: GitHub.