{"record":{"id":"0d8791aba8ead656","repo":"EpicGames/lore","slug":"missing-quic-certificate-config","errorCode":null,"errorMessage":"Missing QUIC certificate config","messagePattern":"Missing QUIC certificate config","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"lore-server/src/server.rs","lineNumber":372,"sourceCode":"        process_limit.saturating_mul(streams as usize)\n    })\n}\n\nasync fn launch_quinn_server(\n    name: &'static str,\n    stream_handler_factory: Box<dyn StreamHandlerFactory>,\n    metrics_frequency: Duration,\n    quic_settings: QuicSettings,\n    generate_ephemeral_cert: bool,\n    mut shutdown_rx: tokio::sync::watch::Receiver<bool>,\n) -> Result<()> {\n    let span = info_span!(\"QUIC server\", name);\n\n    async {\n        let cert_settings = match quic_settings.certificate.clone() {\n            Some(cert_settings) => cert_settings,\n            None if generate_ephemeral_cert => generate_ephemeral_certificate(name)?,\n            None => return Err(anyhow!(\"Missing QUIC certificate config\")),\n        };\n\n        let client_verifier = if quic_settings.verify_client_certs {\n            let ca_path = cert_settings\n                .cert_chain\n                .clone()\n                .ok_or(anyhow!(\"Missing cert chain\"))?;\n            build_cert_verifier(ca_path)?\n        } else {\n            Arc::new(NoClientAuth {})\n        };\n\n        let addr = SocketAddr::from_str(\n            format!(\"{}:{}\", quic_settings.host, quic_settings.port).as_str(),\n        )?;\n\n        let mut settings_builder: QuinnConfigBuilder = quic_settings.into();\n","sourceCodeStart":354,"sourceCodeEnd":390,"githubUrl":"https://github.com/EpicGames/lore/blob/074eb0b0d1194c997d7cf28b55519e3e197b3e23/lore-server/src/server.rs#L354-L390","documentation":"launch_quinn_server needs TLS certificates for QUIC: either an explicitly configured certificate or, when allowed, an auto-generated ephemeral one. If quic_settings.certificate is None and ephemeral generation is not enabled, startup fails with this error.","triggerScenarios":"QUIC settings present without a certificate section, and launch_quinn_server invoked with generate_ephemeral_cert = false (e.g. production mode).","commonSituations":"Deploying with a stripped-down config that omits the quic certificate block; running in production where ephemeral certs are intentionally disabled; forgetting to mount cert files in containers.","solutions":["Add the certificate (and key) settings under the QUIC config section","Enable ephemeral certificate generation if appropriate for the environment (dev/test)","Verify config file and mounts so the certificate section actually reaches quic_settings"],"exampleFix":"// before\n[quic]\nverify_client_certs = false\n// after\n[quic.certificate]\ncert = \"/etc/certs/server.crt\"\nkey = \"/etc/certs/server.key\"","handlingStrategy":"validation","validationCode":"fn validate_quic_certs(s: &QuicSettings, allow_ephemeral: bool) -> Result<(), String> {\n    if s.certificate.is_none() && !allow_ephemeral {\n        return Err(\"QUIC enabled but no certificate configured and ephemeral certs disabled\".into());\n    }\n    Ok(())\n}","typeGuard":"fn has_quic_certs(s: &QuicSettings) -> bool { s.certificate.is_some() }","tryCatchPattern":"match launch_quinn_server(&settings, false).await {\n    Err(e) if e.to_string().contains(\"Missing QUIC certificate\") => eprintln!(\"provide quic.certificate config or enable ephemeral certs\"),\n    r => r?,\n}","preventionTips":["Ship a config schema check that requires quic.certificate in production profiles","Document the ephemeral-cert flag as dev-only","Mount cert files in container images before enabling QUIC"],"tags":["rust","quic","tls","configuration"],"backgroundTag":"missing-required-config-field","analyzedSha":"074eb0b0d1194c997d7cf28b55519e3e197b3e23","analyzedAt":"2026-09-13T09:00:57.509Z","contentChangedAt":"2026-09-13T09:00:57.509Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}