Cassandra Internode TLS: DNS Mismatch When require_endpoint_verification is True

Goal

Diagnose SSL handshake failures that arise when Cassandra nodes connect using IP addresses while the peer’s TLS certificate lists only DNS names.

Constraints

The cluster runs with require_endpoint_verification=true to enforce hostname checks, but nodes are configured with listen_address or broadcast_address as static IPs. This mismatch triggers javax.net.ssl.SSLHandshakeException during inter‑node communication.

Uncertainty

Operators must decide whether to keep strict verification (risking operational disruption) or relax it (exposing the cluster to man‑in‑the‑middle attacks if a CA‑signed certificate is compromised).

Questions

• What are the documented best‑practice patterns for reconciling IP‑based node configuration with DNS‑based certificate SANs while keeping require_endpoint_verification enabled?
• How does disabling require_endpoint_verification affect the cluster’s security posture in a mixed IP/DNS environment?
• Can Cassandra’s internode TLS configuration be adjusted (e.g., via ssl_endpoint_identification_algorithm) to allow hostname verification against a custom mapping without disabling the feature?