If not multi-dc cluster, get_seeds will return list of public ec2 names to let DNS server to resolve to private IPs.  As in this case, C* use the normal Ec2Snitch and it does not translate public names to private IPs nicely. C* nodes do connect through Private IPs and non-ssl port eventually but they still hold around the undesired Public IP's OutboundTCPConnection. Also, without this change, Cassandra's handshake connections initially have to go through Public IPs and SSL port before being able to settle down on the private IPs and non-ssl port.