{"record":{"id":"10d966773633f3d9","repo":"sgl-project/sglang","slug":"ssl-certfile-requires-ssl-keyfile-to-be-specif","errorCode":null,"errorMessage":"--ssl-certfile requires --ssl-keyfile to be specified as well.","messagePattern":"--ssl-certfile requires --ssl-keyfile to be specified as well\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"python/sglang/srt/server_args.py","lineNumber":4314,"sourceCode":"            self._declare(\n                \"_handle_load_balance_method\",\n                load_balance_method=(\n                    \"follow_bootstrap_room\"\n                    if cfg.disaggregation_mode == \"prefill\"\n                    else \"round_robin\"\n                ),\n            )\n            return\n\n    def _handle_ssl_validation(self):\n        \"\"\"Ensure SSL arguments are consistent and referenced files exist.\"\"\"\n        cfg = resolving_view(self)\n        if cfg.ssl_keyfile and not cfg.ssl_certfile:\n            raise ValueError(\n                \"--ssl-keyfile requires --ssl-certfile to be specified as well.\"\n            )\n        if cfg.ssl_certfile and not cfg.ssl_keyfile:\n            raise ValueError(\n                \"--ssl-certfile requires --ssl-keyfile to be specified as well.\"\n            )\n        if not cfg.ssl_certfile and not cfg.ssl_keyfile:\n            if cfg.ssl_ca_certs:\n                raise ValueError(\n                    \"--ssl-ca-certs has no effect without --ssl-certfile and --ssl-keyfile.\"\n                )\n            if cfg.ssl_keyfile_password:\n                raise ValueError(\n                    \"--ssl-keyfile-password has no effect without --ssl-certfile and --ssl-keyfile.\"\n                )\n        # Validate files exist early to avoid late failures after model loading.\n        if cfg.ssl_keyfile and not os.path.isfile(cfg.ssl_keyfile):\n            raise ValueError(\n                f\"SSL key file not found: '{cfg.ssl_keyfile}'. \"\n                f\"Please check the --ssl-keyfile path.\"\n            )\n        if cfg.ssl_certfile and not os.path.isfile(cfg.ssl_certfile):","sourceCodeStart":4296,"sourceCodeEnd":4332,"githubUrl":"https://github.com/sgl-project/sglang/blob/0132848349585cfe6aae51c4941cbae872505f8a/python/sglang/srt/server_args.py#L4296-L4332","documentation":"ServerArgs validation error raised when --ssl-certfile is provided without --ssl-keyfile. A certificate alone is not enough; the server needs the private key to complete the TLS handshake, so SGLang validates the pair up front.","triggerScenarios":"Launching with --ssl-certfile server.crt while omitting --ssl-keyfile.","commonSituations":"Ops templates that only expose the cert path; cert renewed via automation but key flag dropped; misconfigured Helm values or systemd unit.","solutions":["Add the matching --ssl-keyfile server.key to the command","Verify both files exist and the key matches the certificate"],"exampleFix":"# before\n--ssl-certfile server.crt\n# after\n--ssl-certfile server.crt --ssl-keyfile server.key","handlingStrategy":"validation","validationCode":"import os\n\ndef ssl_flags(cert: str | None, key: str | None) -> list[str]:\n    if bool(cert) != bool(key):\n        raise ValueError(\"--ssl-certfile and --ssl-keyfile must be provided together\")\n    return ([] if not cert else [\"--ssl-certfile\", cert, \"ssl-keyfile\", key])","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat TLS config as one unit (cert + key + optional ca) toggled by a single enable switch","Never template one of the pair conditionally without the other"],"tags":["sglang","ssl","tls","server-config","argument-validation"],"backgroundTag":"ssl-certificate-configuration","analyzedSha":"0132848349585cfe6aae51c4941cbae872505f8a","analyzedAt":"2026-08-28T05:10:05.995Z","schemaVersion":2},"datasetVersion":"2026-08-28T06:17:29.519Z"}