{"record":{"id":"189b6059d80cd8b2","repo":"sgl-project/sglang","slug":"ssl-keyfile-password-has-no-effect-without-ssl","errorCode":null,"errorMessage":"--ssl-keyfile-password has no effect without --ssl-certfile and --ssl-keyfile.","messagePattern":"--ssl-keyfile-password has no effect without --ssl-certfile and --ssl-keyfile\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"python/sglang/srt/server_args.py","lineNumber":4323,"sourceCode":"\n    def _handle_ssl_validation(self):\n        \"\"\"Ensure SSL arguments are consistent and referenced files exist.\"\"\"\n        cfg = resolving_view(self)\n        if cfg.ssl_keyfile and not cfg.ssl_certfile:\n            raise ValueError(\n                \"--ssl-keyfile requires --ssl-certfile to be specified as well.\"\n            )\n        if cfg.ssl_certfile and not cfg.ssl_keyfile:\n            raise ValueError(\n                \"--ssl-certfile requires --ssl-keyfile to be specified as well.\"\n            )\n        if not cfg.ssl_certfile and not cfg.ssl_keyfile:\n            if cfg.ssl_ca_certs:\n                raise ValueError(\n                    \"--ssl-ca-certs has no effect without --ssl-certfile and --ssl-keyfile.\"\n                )\n            if cfg.ssl_keyfile_password:\n                raise ValueError(\n                    \"--ssl-keyfile-password has no effect without --ssl-certfile and --ssl-keyfile.\"\n                )\n        # Validate files exist early to avoid late failures after model loading.\n        if cfg.ssl_keyfile and not os.path.isfile(cfg.ssl_keyfile):\n            raise ValueError(\n                f\"SSL key file not found: '{cfg.ssl_keyfile}'. \"\n                f\"Please check the --ssl-keyfile path.\"\n            )\n        if cfg.ssl_certfile and not os.path.isfile(cfg.ssl_certfile):\n            raise ValueError(\n                f\"SSL certificate file not found: '{cfg.ssl_certfile}'. \"\n                f\"Please check the --ssl-certfile path.\"\n            )\n        if cfg.ssl_ca_certs and not os.path.isfile(cfg.ssl_ca_certs):\n            raise ValueError(\n                f\"SSL CA certificates file not found: '{cfg.ssl_ca_certs}'. \"\n                f\"Please check the --ssl-ca-certs path.\"\n            )","sourceCodeStart":4305,"sourceCodeEnd":4341,"githubUrl":"https://github.com/sgl-project/sglang/blob/0132848349585cfe6aae51c4941cbae872505f8a/python/sglang/srt/server_args.py#L4305-L4341","documentation":"ServerArgs validation error raised when --ssl-keyfile-password is set but neither --ssl-certfile nor --ssl-keyfile is. The password decrypts the (encrypted) private key, so it is meaningless without the key file; SGLang fails fast to catch the incomplete TLS setup.","triggerScenarios":"Launching with --ssl-keyfile-password **** while omitting both --ssl-keyfile and --ssl-certfile.","commonSituations":"Secrets injected via environment automation while the file flags were dropped; leftover config after moving to unencrypted keys; templated launch commands with conditional flags evaluated inconsistently.","solutions":["Add --ssl-keyfile (and --ssl-certfile) to actually enable TLS","If not using TLS, remove --ssl-keyfile-password from the command/secret store"],"exampleFix":"# before\n--ssl-keyfile-password $SSL_PASS\n# after\n--ssl-certfile server.crt --ssl-keyfile server.enc.key --ssl-keyfile-password $SSL_PASS","handlingStrategy":"validation","validationCode":"def key_password_allowed(cert: str | None, key: str | None, pw: str | None) -> bool:\n    return not pw or bool(cert and key)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Inject --ssl-keyfile-password only through the same secret/template path that sets cert and key","Audit secret stores for orphaned TLS password entries after config changes"],"tags":["sglang","ssl","tls","secrets","argument-validation"],"backgroundTag":"ssl-certificate-configuration","analyzedSha":"0132848349585cfe6aae51c4941cbae872505f8a","analyzedAt":"2026-08-28T05:10:05.995Z","schemaVersion":2},"datasetVersion":"2026-08-28T06:17:29.519Z"}