{"record":{"id":"1875805e48cf3705","repo":"phacility/phabricator","slug":"a-specified-server-at-index-s-on-port-s-s-187580","errorCode":null,"errorMessage":"A specified server (at index \"%s\", on port \"%s\") specifies a value for \"%s\", but no value for \"%s\" or \"%s\". Servers should only provide an SSL chain if they also provide an SSL key and SSL certificate.","messagePattern":"A specified server \\(at index \"(.+?)\", on port \"(.+?)\"\\) specifies a value for \"(.+?)\", but no value for \"(.+?)\" or \"(.+?)\"\\. Servers should only provide an SSL chain if they also provide an SSL key and SSL certificate\\.","errorType":"console","errorClass":"PhutilArgumentUsageException","httpStatus":null,"severity":"error","filePath":"src/applications/aphlict/management/PhabricatorAphlictManagementWorkflow.php","lineNumber":154,"sourceCode":"      }\n\n      $ssl_key = idx($server, 'ssl.key');\n      $ssl_cert = idx($server, 'ssl.cert');\n      if (($ssl_key && !$ssl_cert) || ($ssl_cert && !$ssl_key)) {\n        throw new PhutilArgumentUsageException(\n          pht(\n            'A specified server (at index \"%s\", on port \"%s\") specifies '.\n            'only one of \"%s\" and \"%s\". Each server must specify neither '.\n            '(to disable SSL) or specify both (to enable it).',\n            $index,\n            $port,\n            'ssl.key',\n            'ssl.cert'));\n      }\n\n      $ssl_chain = idx($server, 'ssl.chain');\n      if ($ssl_chain && (!$ssl_key && !$ssl_cert)) {\n        throw new PhutilArgumentUsageException(\n          pht(\n            'A specified server (at index \"%s\", on port \"%s\") specifies '.\n            'a value for \"%s\", but no value for \"%s\" or \"%s\". Servers '.\n            'should only provide an SSL chain if they also provide an SSL '.\n            'key and SSL certificate.',\n            $index,\n            $port,\n            'ssl.chain',\n            'ssl.key',\n            'ssl.cert'));\n      }\n    }\n\n    if (!$servers) {\n      throw new PhutilArgumentUsageException(\n        pht(\n          'Configuration file does not specify any servers. This service '.\n          'will not be able to interact with the outside world if it does '.","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/aphlict/management/PhabricatorAphlictManagementWorkflow.php#L136-L172","documentation":"Thrown when an Aphlict server entry sets 'ssl.chain' (the certificate chain file) but supplies neither 'ssl.key' nor 'ssl.cert'. A chain is only meaningful together with a key and certificate, so this combination is rejected.","triggerScenarios":"A server entry contains \"ssl.chain\": \"/etc/ssl/ca-bundle.crt\" while ssl.key and ssl.cert are absent or null — e.g. someone added the chain first intending to add the rest later, or a template sets chain unconditionally.","commonSituations":"Ansible/Puppet templates that always emit ssl.chain but conditionally omit key/cert for non-TLS hosts; partial migration to HTTPS.","solutions":["Add both \"ssl.key\" and \"ssl.cert\" alongside \"ssl.chain\" to fully enable SSL on that server","Or remove \"ssl.chain\" if this listener is meant to stay plaintext"],"exampleFix":"// before\n{\"type\": \"admin\", \"port\": 22281, \"ssl.chain\": \"/etc/ssl/chain.crt\"}\n// after\n{\"type\": \"admin\", \"port\": 22281,\n \"ssl.key\": \"/etc/ssl/aphlict.key\",\n \"ssl.cert\": \"/etc/ssl/aphlict.crt\",\n \"ssl.chain\": \"/etc/ssl/chain.crt\"}","handlingStrategy":"validation","validationCode":"$chain = idx($server, 'ssl.chain');\nif ($chain && (!idx($server, 'ssl.key') && !idx($server, 'ssl.cert'))) {\n  throw new InvalidArgumentException('ssl.chain requires ssl.key and ssl.cert');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only emit ssl.chain from templates when key and cert are also being set"],"tags":["aphlict","ssl","configuration","phabricator"],"backgroundTag":"ssl-certificate-config","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}