EpicGames/lore · error · anyhow::Error

certificate is partially configured: certificate.cert_file…

Error message

{label} certificate is partially configured: certificate.cert_file and certificate.pkey_file are set but certificate.cert_chain (the CA used to verify client certs) is missing. The endpoint requires mTLS, not server-only TLS

What it means

Thrown by validate_endpoint_security when verify_client_certs is true and a certificate is supplied with cert_file and pkey_file but no cert_chain. Without the CA chain the endpoint cannot verify client certificates, so it would silently degrade to server-only TLS instead of the required mTLS; the server refuses to start rather than misrepresent security.

Solutions

Set certificate.cert_chain to the CA certificate file used to verify client certs.
If mTLS is not intended, set verify_client_certs = false to explicitly choose server-only TLS.
Ensure all three fields (cert_file, pkey_file, cert_chain) are present in the same certificate block.

Example fix

# before
[server.certificate]
cert_file = "server.crt"
pkey_file = "server.key"

# after
[server.certificate]
cert_file = "server.crt"
pkey_file = "server.key"
cert_chain = "ca.crt"

Defensive patterns

Strategy: validation

Validate before calling

if verify_client_certs {
    match &certificate {
        Some(c) if c.cert_chain.is_none() => {
            return Err(anyhow!("mTLS requires cert_file, pkey_file, and cert_chain"));
        }
        None => return Err(anyhow!("mTLS requires a certificate block")),
        _ => {}
    }
}

Type guard

fn is_full_mtls_triple(cert: &Option<Certificate>) -> bool {
    matches!(cert, Some(c) if c.cert_file.is_some() && c.pkey_file.is_some() && c.cert_chain.is_some())
}

Prevention

Always configure cert_file, pkey_file, and cert_chain together as a unit.
Lint config files at CI time for mTLS endpoints requiring the full triple.
Explicitly set verify_client_certs = false when server-only TLS is intended.

When it happens

Trigger: validate_endpoint_security called with verify_client_certs=true and Some(certificate) where certificate.cert_chain is None while cert_file/pkey_file are set.

Common situations: Operator configures the server cert/key pair but forgets the CA bundle used to verify clients; reusing a plain-TLS cert config for an mTLS endpoint; partial migration from TLS to mTLS.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of EpicGames/lore@074eb0b0d1 (2026-09-13). Data as JSON: /api/errors/8db8bfca4d8900c3. Report an issue: GitHub.

Appendix: source

Thrown at lore-server/src/server.rs:566

///
/// Returns:
/// - `Ok(Mtls)` when `verify_client_certs = true` and `certificate`
///   carries a full triple (`cert_file` + `pkey_file` + `cert_chain`).
/// - `Ok(Untrusted)` when `verify_client_certs = false`. The caller is
///   responsible for emitting a startup warning.
/// - `Err` when `verify_client_certs = true` but the certificate is
///   missing or only partially configured.
fn validate_endpoint_security(
    label: &str,
    certificate: Option<&crate::tls::CertificateSettings>,
    verify_client_certs: bool,
) -> Result<EndpointSecurity> {
    if !verify_client_certs {
        return Ok(EndpointSecurity::Untrusted);
    }
    match certificate {
        Some(cert) if cert.cert_chain.is_some() => Ok(EndpointSecurity::Mtls),
        Some(_) => Err(anyhow!(
            "{label} certificate is partially configured: \
             certificate.cert_file and certificate.pkey_file are set but \
             certificate.cert_chain (the CA used to verify client certs) \
             is missing. The endpoint requires mTLS, not server-only TLS"
        )),
        None => Err(anyhow!(
            "{label} requires mTLS to start (verify_client_certs = true). \
             Configure certificate.cert_file, certificate.pkey_file, and \
             certificate.cert_chain, or set verify_client_certs = false \
             to explicitly accept the security exposure"
        )),
    }
}

#[allow(clippy::too_many_arguments)]
async fn launch_grpc_internal_server(
    settings: Settings,
    user_agent_filter: Arc<UserAgentFilter>,

View on GitHub (pinned to 074eb0b0d1)