What causes "Bad cert paths" in EpicGames/lore?

Run server_certs() directly in a small test to see its underlying Err

Bad cert paths

Error message

Bad cert paths

What it means

This expect wraps server_certs(), the helper that locates/creates the test TLS certificate and private key files used by QuinnServer. It panics when the cert/key files cannot be found, generated, or parsed.

Solutions

Run server_certs() directly in a small test to see its underlying Err
Ensure the test environment allows writing/reading the cert directory the helper uses
Regenerate test certificates (cargo test usually does this via the helper) and confirm files exist
Check rcgen dependency versions for API/path changes in cert generation

Example fix

// before
let (cert_path, key_path, _) = server_certs().expect("Bad cert paths");
// after
let (cert_path, key_path, _) = server_certs()
    .unwrap_or_else(|e| panic!("Bad cert paths: {e:?}; cwd={:?}", std::env::current_dir()));

Defensive patterns

Strategy: validation

Validate before calling

let cert_path = std::path::Path::new(&cert_path);
let key_path = std::path::Path::new(&key_path);
assert!(cert_path.exists(), "cert missing: {:?}", cert_path);
assert!(key_path.exists(), "key missing: {:?}", key_path);

Type guard

fn certs_present(cert: &std::path::Path, key: &std::path::Path) -> bool {
    cert.is_file() && key.is_file()
}

Prevention

Call the cert helper once and reuse the paths rather than regenerating per test
Ensure the test workspace is writable and not scrubbed between CI steps
Pin rcgen versions to avoid path/API drift in cert generation

When it happens

Trigger: server_certs() cannot locate the embedded/generated rcgen cert paths, lacks permission to write the cert directory, or the key material is missing/corrupt.

Common situations: Running tests in a read-only or scrubbed CI workspace where generated certs were deleted; rcgen version change altering the returned paths; wrong working directory assumptions in the cert helper.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

AI-assisted analysis of EpicGames/lore@074eb0b0d1 (2026-09-13). Data as JSON: /api/errors/348b336cd2b63c8e. Report an issue: GitHub.

Appendix: source

Thrown at lore-server/src/quic/stream_handler.rs:874

        recv.read_exact(&mut buffer)
            .await
            .expect("Failed to read response");
        CommandHeader::from_bytes(&buffer)
    }

    /// Serve `factory` for `protocol` on a loopback endpoint and open a client stream to it.
    ///
    /// The client skips certificate verification and presents none of its own; the mTLS tests
    /// build their endpoints by hand because varying exactly that is what they test.
    async fn serve_and_connect(
        factory: Box<dyn StreamHandlerFactory>,
        protocol: &'static str,
    ) -> Harness {
        let socket = UdpSocket::bind("127.0.0.1:0").unwrap();
        let server_addr = socket.local_addr().expect("Failed socket setup");
        drop(socket);

        let (cert_path, key_path, _) = server_certs().expect("Bad cert paths");
        let server = QuinnServer::start(
            QuinnConfigBuilder::new()
                .address(server_addr)
                .cert_file(cert_path)
                .pkey_file(key_path)
                .stream_handler_factory(factory)
                .build()
                .unwrap(),
        )
        .expect("Failed Quinn server start");

        let mut crypto_config = rustls::ClientConfig::builder()
            .dangerous()
            .with_custom_certificate_verifier(insecure_client_auth::SkipServerVerification::new())
            .with_no_client_auth();
        crypto_config.alpn_protocols = vec![protocol.as_bytes().into()];

        let client_config = ClientConfig::new(Arc::new(

View on GitHub (pinned to 074eb0b0d1)