EpicGames/lore · error · anyhow::Error

requires mTLS to start (verify_client_certs = true)…

Error message

{label} requires mTLS to start (verify_client_certs = true). Configure certificate.cert_file, certificate.pkey_file, and certificate.cert_chain, or set verify_client_certs = false to explicitly accept the security exposure

What it means

Thrown by validate_endpoint_security when verify_client_certs is true but no certificate configuration exists at all. An endpoint that must verify client certs needs a full mTLS triple (cert_file, pkey_file, cert_chain); the server refuses to start so the operator must either supply the triple or explicitly opt out.

Solutions

Configure certificate.cert_file, certificate.pkey_file, and certificate.cert_chain for the endpoint.
If the exposure is acceptable, set verify_client_certs = false to explicitly disable mTLS.
Confirm the config file section names match the current Settings schema.

Example fix

# before
[server]
verify_client_certs = true

# after
[server]
verify_client_certs = true
[server.certificate]
cert_file = "server.crt"
pkey_file = "server.key"
cert_chain = "ca.crt"

Defensive patterns

Strategy: validation

Validate before calling

if verify_client_certs && certificate.is_none() {
    return Err(anyhow!("verify_client_certs=true but no [server.certificate] configured"));
}

Type guard

fn mtls_ready(verify: bool, cert: &Option<Certificate>) -> bool {
    !verify || matches!(cert, Some(c) if c.cert_chain.is_some())
}

Prevention

Never enable verify_client_certs without a complete certificate block in the same config.
Run a pre-start config validation that checks the mTLS triple when verification is on.
Document that disabling verification is an explicit security opt-out.

When it happens

Trigger: validate_endpoint_security called with verify_client_certs=true and certificate = None.

Common situations: Fresh deployment where [server.certificate] was never added but verify_client_certs = true was copied in; config template with verify enabled by default; operator forgot to configure any TLS material.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of EpicGames/lore@074eb0b0d1 (2026-09-13). Data as JSON: /api/errors/51cca50dc0d592af. Report an issue: GitHub.

Appendix: source

Thrown at lore-server/src/server.rs:572

/// - `Err` when `verify_client_certs = true` but the certificate is
///   missing or only partially configured.
fn validate_endpoint_security(
    label: &str,
    certificate: Option<&crate::tls::CertificateSettings>,
    verify_client_certs: bool,
) -> Result<EndpointSecurity> {
    if !verify_client_certs {
        return Ok(EndpointSecurity::Untrusted);
    }
    match certificate {
        Some(cert) if cert.cert_chain.is_some() => Ok(EndpointSecurity::Mtls),
        Some(_) => Err(anyhow!(
            "{label} certificate is partially configured: \
             certificate.cert_file and certificate.pkey_file are set but \
             certificate.cert_chain (the CA used to verify client certs) \
             is missing. The endpoint requires mTLS, not server-only TLS"
        )),
        None => Err(anyhow!(
            "{label} requires mTLS to start (verify_client_certs = true). \
             Configure certificate.cert_file, certificate.pkey_file, and \
             certificate.cert_chain, or set verify_client_certs = false \
             to explicitly accept the security exposure"
        )),
    }
}

#[allow(clippy::too_many_arguments)]
async fn launch_grpc_internal_server(
    settings: Settings,
    user_agent_filter: Arc<UserAgentFilter>,
    immutable_store: Arc<dyn ImmutableStore>,
    mutable_store: Arc<dyn MutableStore>,
    notification_sender: Arc<dyn NotificationSender>,
    hook_dispatcher: Arc<HookDispatcher>,
    mut shutdown_rx: tokio::sync::watch::Receiver<bool>,
) -> Result<()> {

View on GitHub (pinned to 074eb0b0d1)