alibaba/nacos · error · IllegalArgumentException

Server certChainFile or certPrivateKey must be not null

Error message

Server certChainFile or certPrivateKey must be not null

What it means

Error "Server certChainFile or certPrivateKey must be not null" thrown in alibaba/nacos.

Source

Thrown at core/src/main/java/com/alibaba/nacos/core/remote/grpc/negotiator/tls/DefaultTlsContextBuilder.java:53

import javax.net.ssl.SSLException;
import java.io.IOException;
import java.io.InputStream;
import java.util.Arrays;

/**
 * Ssl context builder.
 *
 * @author xiweng.yy
 */
public class DefaultTlsContextBuilder {
    
    private static final ResourceLoader RESOURCE_LOADER = new DefaultResourceLoader();
    
    static SslContext getSslContext(RpcServerTlsConfig rpcServerTlsConfig) {
        try {
            if (StringUtils.isBlank(rpcServerTlsConfig.getCertChainFile()) || StringUtils
                .isBlank(rpcServerTlsConfig.getCertPrivateKey())) {
                throw new IllegalArgumentException(
                    "Server certChainFile or certPrivateKey must be not null");
            }
            InputStream certificateChainFile =
                getInputStream(rpcServerTlsConfig.getCertChainFile(), "certChainFile");
            InputStream privateKeyFile =
                getInputStream(rpcServerTlsConfig.getCertPrivateKey(), "certPrivateKey");
            SslContextBuilder sslClientContextBuilder = SslContextBuilder
                .forServer(certificateChainFile, privateKeyFile,
                    rpcServerTlsConfig.getCertPrivateKeyPassword());
            
            if (StringUtils.isNotBlank(rpcServerTlsConfig.getProtocols())) {
                sslClientContextBuilder.protocols(rpcServerTlsConfig.getProtocols().split(","));
            }
            
            if (StringUtils.isNotBlank(rpcServerTlsConfig.getCiphers())) {
                sslClientContextBuilder
                    .ciphers(Arrays.asList(rpcServerTlsConfig.getCiphers().split(",")));
            }

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Correct the invalid value for server TLS cert missing to match the expected format or allowed set, then retry.

When it happens

Trigger: Thrown at core/src/main/java/com/alibaba/nacos/core/remote/grpc/negotiator/tls/DefaultTlsContextBuilder.java:53 when the library encounters an invalid state.

Common situations: Starting a TLS gRPC server without certChainFile or certPrivateKey configured.

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/7b81a9818d6b1dbc. Report an issue: GitHub.