AlistGo/alist · error

TLS config not provided

Error message

TLS config not provided

What it means

Returned by FtpMainDriver.GetTLSConfig when the server was constructed without a tls.Config, which happens when getTlsConf() failed or was never given certificate paths. The ftpserver library calls this driver hook when a client issues AUTH TLS, so this error surfaces as the FTPS handshake failing.

Source

Thrown at server/ftp.go:153

	if userObj.Disabled || !common.HasPermission(perm, common.PermFTPAccess) {
		return nil, errors.New("user is not allowed to access via FTP")
	}

	ctx := context.Background()
	ctx = context.WithValue(ctx, "user", userObj)
	if user == "anonymous" || user == "guest" {
		ctx = context.WithValue(ctx, "meta_pass", pass)
	} else {
		ctx = context.WithValue(ctx, "meta_pass", "")
	}
	ctx = context.WithValue(ctx, "client_ip", cc.RemoteAddr().String())
	ctx = context.WithValue(ctx, "proxy_header", d.proxyHeader)
	return ftp.NewAferoAdapter(ctx), nil
}

func (d *FtpMainDriver) GetTLSConfig() (*tls.Config, error) {
	if d.tlsConfig == nil {
		return nil, errors.New("TLS config not provided")
	}
	return d.tlsConfig, nil
}

func (d *FtpMainDriver) Stop() {
	d.isShutdown = true
	d.shutdownLock.Lock()
	defer d.shutdownLock.Unlock()
	for _, value := range d.clients {
		_ = value.Close()
	}
}

func lookupIP(host string) string {
	if host == "" || net.ParseIP(host) != nil {
		return host
	}
	ips, err := net.LookupIP(host)

View on GitHub (pinned to 843d9dc814)

Solutions

1. Set both ftp tls certificate and private key file paths in the FTP settings (they are only valid as a pair)
2. Verify the files are readable by the AList process and contain a matching cert/key pair (openssl x509 / openssl pkey)
3. If TLS is not intended, reconfigure the client to use plain FTP instead of AUTH TLS

Example fix

// before: settings lack TLS material
ftp:
  tls_cert_file: ""
  tls_key_file: ""
// after
ftp:
  tls_cert_file: "/etc/alist/cert.pem"
  tls_key_file: "/etc/alist/key.pem"

// Before enabling the FTPS listener, verify both cert files load
_, err := getTlsConf(cfg.FTP.TLSKeyFile, cfg.FTP.TLSCertFile)
if err != nil {
    log.Fatalf("FTPS not configured: %v", err)
}

tlsConf, err := driver.GetTLSConfig()
if err != nil {
    if strings.Contains(err.Error(), "TLS config not provided") {
        // fall back to plain FTP or fail fast with a config hint
    }
    return err
}

When it happens

Trigger: Client sends 'AUTH TLS'/'AUTH SSL' on the control channel while the ftp.tls_cert_file / ftp.tls_key_file settings are unset or the files could not be loaded at server start.

Common situations: Admin enabled the FTPS listener port but forgot to configure the TLS certificate and private key paths; cert file present but unreadable due to permissions, so the driver silently started without TLS; using FTPS against a plain-FTP-only deployment.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• private key or certificate is not provided
• invalid port
• the number of exposed ports and listened ports does not matc
• remote_path is required
• chunk_size must be positive

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/edb4f04155368c3b. Report an issue: GitHub.