Java truststore and keystore files are not supported; use db

Error message

Java truststore and keystore files are not supported; use dbx.cassandra.tls PEM paths

What it means

The Java driver's SSL engine factory can point to JKS/PKCS12 truststore and keystore files via truststore-path/keystore-path. applyHOCONSSL (config_file.go:270) rejects any non-empty value for either key because the Go driver consumes PEM-encoded certificate files, not Java keystores. TLS must be configured with native dbx.cassandra.tls PEM paths.

Source

Thrown at agents/drivers/cassandra-go/config_file.go:270

	if value, ok, err := hoconString(parsed, prefix+"class"); err != nil {
		return err
	} else if ok {
		if !strings.EqualFold(simpleClassName(value), "DefaultSslEngineFactory") {
			return fmt.Errorf("unsupported Cassandra SSL engine factory class: %s", value)
		}
		config.ssl = true
	}
	if value, ok, err := hoconBool(parsed, prefix+"hostname-validation"); err != nil {
		return err
	} else if ok {
		config.hostVerification = value
		config.ssl = true
	}
	for _, path := range []string{prefix + "truststore-path", prefix + "keystore-path"} {
		if value, ok, err := hoconString(parsed, path); err != nil {
			return err
		} else if ok && value != "" {
			return fmt.Errorf("Java truststore and keystore files are not supported; use dbx.cassandra.tls PEM paths")
		}
	}
	return nil
}

func applyNativeHOCON(config *cassandraConfig, parsed *hocon.Config) error {
	prefix := "dbx.cassandra."
	stringMappings := []struct {
		path   string
		target *string
	}{
		{"tls.ca-cert-path", &config.caCertPath},
		{"tls.client-cert-path", &config.clientCertPath},
		{"tls.client-key-path", &config.clientKeyPath},
		{"kerberos.config", &config.kerberos.configPath},
		{"kerberos.jaas-config", &config.kerberos.jaasConfigPath},
		{"kerberos.principal", &config.kerberos.principal},
		{"kerberos.realm", &config.kerberos.realm},

View on GitHub (pinned to c0390bff16)

Solutions

Remove truststore-path and keystore-path from the HOCON file.
Convert the Java keystore/truststore to PEM (e.g. `keytool -importkeystore` then `openssl pkcs12 -in out.p12 -nokeys -out ca.pem`, and for keys `openssl pkcs12 -nodes -out client.pem`).
Point the native options dbx.cassandra.tls.ca-cert-path, tls.client-cert-path, and tls.client-key-path at the resulting PEM files.
If the JVM fleet must stay on keystores, keep separate configs for the Java and Go clients.

Example fix

// before (application.conf)
datastax-java-driver {
  advanced.ssl-engine-factory {
    truststore-path = /etc/ssl/truststore.jks
    keystore-path = /etc/ssl/keystore.p12
  }
}
// after
# keys removed; native options instead
# dbx.cassandra.tls.ca-cert-path = /etc/ssl/ca.pem
# dbx.cassandra.tls.client-cert-path = /etc/ssl/client-cert.pem
# dbx.cassandra.tls.client-key-path = /etc/ssl/client-key.pem

Defensive patterns

Strategy: validation

Validate before calling

func validateNoJavaKeystores(cfg *hocon.Config) error {
    prefix := "datastax-java-driver.advanced.ssl-engine-factory."
    for _, k := range []string{"truststore-path", "keystore-path"} {
        if cfg.Get(prefix+k) == nil {
            continue
        }
        if v := strings.TrimSpace(cfg.GetString(prefix + k)); v != "" {
            return fmt.Errorf("%s is unsupported; use PEM files via dbx.cassandra.tls", prefix+k)
        }
    }
    return nil
}

Try / catch

if err := applyCassandraConfigFile(cfgPath); err != nil {
    if strings.Contains(err.Error(), "truststore and keystore files are not supported") {
        log.Fatalf("convert JKS/PKCS12 stores to PEM and use dbx.cassandra.tls.*-path options")
    }
    return err
}

Prevention

Standardize on PEM certificates for Go clients; keep keystores only for JVM clients.
Add a pre-deploy step converting keystores to PEM (keytool + openssl).
Grep shared configs for 'truststore-path' / 'keystore-path' before rolling out to Go services.

When it happens

Trigger: A HOCON file contains `advanced.ssl-engine-factory.truststore-path` and/or `keystore-path` set to a .jks/.p12 file path while the Java driver SSL section is being applied.

Common situations: Direct port of a JVM Cassandra client config that used /etc/ssl/truststore.jks; enterprise PKI setups that issued Java keystores to developers; mixed JVM/Go fleets sharing one application.conf.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/c471cbfb7fc2bb06. Report an issue: GitHub.