AlistGo/alist · error

private key or certificate is not provided

Error message

private key or certificate is not provided

What it means

Returned by getTlsConf before any file I/O when either the private key path or the certificate path is empty. The two TLS settings are only meaningful together; leaving one blank aborts TLS setup, which in turn leaves the FTP driver with a nil tls.Config (surfacing later as 'TLS config not provided' on AUTH TLS).

Source

Thrown at server/ftp.go:275

		}
	}
	return func() (int, int, bool) {
		idxPort := rand.Intn(totalLength)
		for _, g := range groups {
			if idxPort >= g.Length {
				idxPort -= g.Length
			} else {
				return g.ExposedStart + idxPort, g.ListenedStart + idxPort, true
			}
		}
		// unreachable
		return 0, 0, false
	}
}

func getTlsConf(keyPath, certPath string) (*tls.Config, error) {
	if keyPath == "" || certPath == "" {
		return nil, errors.New("private key or certificate is not provided")
	}
	cert, err := os.ReadFile(certPath)
	if err != nil {
		return nil, err
	}
	key, err := os.ReadFile(keyPath)
	if err != nil {
		return nil, err
	}
	tlsCert, err := tls.X509KeyPair(cert, key)
	if err != nil {
		return nil, err
	}
	return &tls.Config{Certificates: []tls.Certificate{tlsCert}}, nil
}

View on GitHub (pinned to 843d9dc814)

Solutions

1. Set both the private key and certificate paths in the FTP settings
2. Double-check neither field was cleared after a settings migration or backup restore
3. Verify the referenced files exist and the pair matches before restarting

Example fix

// before
ftp:
  tls_cert_file: "/etc/alist/cert.pem"
  tls_key_file: ""
// after
ftp:
  tls_cert_file: "/etc/alist/cert.pem"
  tls_key_file: "/etc/alist/key.pem"

func tlsPathsComplete(keyPath, certPath string) bool {
    return keyPath != "" && certPath != ""
}

conf, err := getTlsConf(keyPath, certPath)
if err != nil && strings.Contains(err.Error(), "private key or certificate is not provided") {
    // config bug: exactly one of the two paths is empty — fix settings before retry
    return nil
}

When it happens

Trigger: Server start with only one of ftp.tls_cert_file / ftp.tls_key_file configured; setting a cert path but leaving the key path at its empty default (or vice versa).

Common situations: Filling in the certificate but not the key when configuring FTPS; wiping one field during settings import/restore; using a combined PEM for both and only entering it in one field (the code requires both paths explicitly).

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• TLS config not provided
• invalid port
• the number of exposed ports and listened ports does not matc
• remote_path is required
• chunk_size must be positive

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/5ba02b95bd325efe. Report an issue: GitHub.