XTLS/Xray-core · error

both file and bytes are empty.

Error message

both file and bytes are empty.

What it means

Thrown by readFileOrString when building transport security: the caller asked for certificate/key material but both the file path (f) and the inline string array (s) are empty. The helper prefers the file, falls back to joined inline lines, and errors only when neither is present.

Source

Thrown at infra/conf/transport_method.go:813

	config.MasqString = c.Masquerade.Content
	config.MasqStringHeaders = c.Masquerade.Headers
	config.MasqStringStatusCode = c.Masquerade.StatusCode

	if config.UdpIdleTimeout == 0 {
		config.UdpIdleTimeout = 60
	}

	return config, nil
}

func readFileOrString(f string, s []string) ([]byte, error) {
	if len(f) > 0 {
		return filesystem.ReadCert(f)
	}
	if len(s) > 0 {
		return []byte(strings.Join(s, "\n")), nil
	}
	return nil, errors.New("both file and bytes are empty.")
}

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Add "certificateFile" pointing to an existing PEM file, or inline the PEM under "certificate": ["-----BEGIN CERTIFICATE-----", ...].
2. Remove the empty certificates entry if TLS is not intended.
3. Verify the file path is accessible by the process (absolute paths are safest).

Example fix

// before
"certificates": [{}]
// after
"certificates": [{ "certificateFile": "/etc/xray/cert.pem", "keyFile": "/etc/xray/key.pem" }]

for _, cert := range tls.Certificates {
    if cert.CertificateFile == "" && len(cert.Certificate) == 0 {
        return errors.New("tls certificate entry missing both file and inline bytes")
    }
}

if _, err := secCfg.Build(); err != nil && strings.Contains(err.Error(), "both file and bytes are empty") {
    return errors.New("remove or fill the empty tls certificates[] entry")
}

When it happens

Trigger: A streamSettings.tlsSettings.certificates entry with neither "certificateFile" nor "certificate" (and similarly for keys) — e.g. an empty {} object in the certificates array.

Common situations: Template configs that pre-create an empty certificates placeholder, or YAML/JSON merges dropping the cert fields while leaving the object.

Related errors

• Unknown security "" + c.Security + "".
• please fill in a valid value for "target"
• bridge tag is empty
• bridge domain is empty
• portal tag is empty

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/135bbd654fa77a84. Report an issue: GitHub.