alibaba/nacos · error · IllegalArgumentException

enable mutual auth,trustCollectionCertFile must be not null

Error message

enable mutual auth,trustCollectionCertFile must be not null

What it means

Error "enable mutual auth,trustCollectionCertFile must be not null" thrown in alibaba/nacos.

Source

Thrown at core/src/main/java/com/alibaba/nacos/core/remote/grpc/negotiator/tls/DefaultTlsContextBuilder.java:78

            SslContextBuilder sslClientContextBuilder = SslContextBuilder
                .forServer(certificateChainFile, privateKeyFile,
                    rpcServerTlsConfig.getCertPrivateKeyPassword());
            
            if (StringUtils.isNotBlank(rpcServerTlsConfig.getProtocols())) {
                sslClientContextBuilder.protocols(rpcServerTlsConfig.getProtocols().split(","));
            }
            
            if (StringUtils.isNotBlank(rpcServerTlsConfig.getCiphers())) {
                sslClientContextBuilder
                    .ciphers(Arrays.asList(rpcServerTlsConfig.getCiphers().split(",")));
            }
            if (rpcServerTlsConfig.getMutualAuthEnable()) {
                // trust all certificate
                if (rpcServerTlsConfig.getTrustAll()) {
                    sslClientContextBuilder.trustManager(InsecureTrustManagerFactory.INSTANCE);
                } else {
                    if (StringUtils.isBlank(rpcServerTlsConfig.getTrustCollectionCertFile())) {
                        throw new IllegalArgumentException(
                            "enable mutual auth,trustCollectionCertFile must be not null");
                    }
                    
                    InputStream clientCert =
                        getInputStream(rpcServerTlsConfig.getTrustCollectionCertFile(),
                            "trustCollectionCertFile");
                    sslClientContextBuilder.trustManager(clientCert);
                }
                sslClientContextBuilder.clientAuth(ClientAuth.REQUIRE);
            }
            SslContextBuilder configure = GrpcSslContexts.configure(sslClientContextBuilder,
                TlsTypeResolve.getSslProvider(rpcServerTlsConfig.getSslProvider()));
            return configure.build();
        } catch (SSLException e) {
            Loggers.REMOTE.info("Nacos Rpc server reload ssl context fail tls config:{}",
                JacksonUtils.toJson(rpcServerTlsConfig));
            throw new NacosRuntimeException(NacosException.SERVER_ERROR, e);
        }

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Correct the invalid value for mutual TLS trust cert missing to match the expected format or allowed set, then retry.

When it happens

Trigger: Thrown at core/src/main/java/com/alibaba/nacos/core/remote/grpc/negotiator/tls/DefaultTlsContextBuilder.java:78 when the library encounters an invalid state.

Common situations: Enabling mutual TLS without a trustCollectionCertFile.

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/42a628914dd1a408. Report an issue: GitHub.