EpicGames/lore · error · anyhow::Error

Missing cert chain

Error message

Missing cert chain

What it means

When the QUIC server is configured to verify client certificates (mTLS), a CA certificate chain file is required to build the client cert verifier. If cert_settings.cert_chain is None, startup fails with this error.

Solutions

  1. Set cert_chain in the QUIC certificate settings to point at the CA bundle used to sign client certs
  2. Disable verify_client_certs if client authentication is not actually required
  3. Ensure the CA file exists and is readable at the configured path

Example fix

// before
[quic.certificate]
cert = "/etc/certs/server.crt"
key = "/etc/certs/server.key"
// after
[quic.certificate]
cert = "/etc/certs/server.crt"
key = "/etc/certs/server.key"
cert_chain = "/etc/certs/ca-chain.crt"
Defensive patterns

Strategy: validation

Validate before calling

if quic_settings.verify_client_certs && quic_settings.certificate.as_ref().and_then(|c| c.cert_chain.as_ref()).is_none() {
    return Err("verify_client_certs requires quic.certificate.cert_chain (CA bundle)".into());
}

Type guard

fn mtls_ready(c: &CertSettings) -> bool { c.cert_chain.is_some() }

Try / catch

match launch_quinn_server(&settings, false).await {
    Err(e) if e.to_string().contains("Missing cert chain") => eprintln!("set quic.certificate.cert_chain or disable verify_client_certs"),
    r => r?,
}

Prevention

When it happens

Trigger: quic_settings.verify_client_certs = true but the certificate settings lack a cert_chain (CA bundle) path; build_cert_verifier is never called.

Common situations: Enabling mTLS in config without adding the CA chain; operators setting verify_client_certs by default in hardened deployments but forgetting the CA file; copied config templates missing the field.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of EpicGames/lore@074eb0b0d1 (2026-09-13). Data as JSON: /api/errors/34cb32935cff13c8. Report an issue: GitHub.

Appendix: source

Thrown at lore-server/src/server.rs:379

    metrics_frequency: Duration,
    quic_settings: QuicSettings,
    generate_ephemeral_cert: bool,
    mut shutdown_rx: tokio::sync::watch::Receiver<bool>,
) -> Result<()> {
    let span = info_span!("QUIC server", name);

    async {
        let cert_settings = match quic_settings.certificate.clone() {
            Some(cert_settings) => cert_settings,
            None if generate_ephemeral_cert => generate_ephemeral_certificate(name)?,
            None => return Err(anyhow!("Missing QUIC certificate config")),
        };

        let client_verifier = if quic_settings.verify_client_certs {
            let ca_path = cert_settings
                .cert_chain
                .clone()
                .ok_or(anyhow!("Missing cert chain"))?;
            build_cert_verifier(ca_path)?
        } else {
            Arc::new(NoClientAuth {})
        };

        let addr = SocketAddr::from_str(
            format!("{}:{}", quic_settings.host, quic_settings.port).as_str(),
        )?;

        let mut settings_builder: QuinnConfigBuilder = quic_settings.into();

        settings_builder = settings_builder
            .server_metrics_name(name)
            .address(addr)
            .cert_chain(cert_settings.cert_chain)
            .cert_file(cert_settings.cert_file)
            .pkey_file(cert_settings.pkey_file)
            .client_cert_verifier(client_verifier)

View on GitHub (pinned to 074eb0b0d1)