{"record":{"id":"2ab1bd2fc8bd8364","repo":"goharbor/harbor","slug":"error-the-protocol-is-https-but-attribute-ssl-cer-2ab1bd","errorCode":null,"errorMessage":"Error: The protocol is https but attribute ssl_cert_key is not set","messagePattern":"Error: The protocol is https but attribute ssl_cert_key is not set","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"make/photon/prepare/utils/misc.py","lineNumber":31,"sourceCode":"    if mode > 0:\n        os.chmod(path, mode)\n    if uid > 0 and gid > 0:\n        os.chown(path, uid, gid)\n\n\ndef validate(conf, **kwargs):\n    # Protocol validate\n    protocol = conf.get(\"configuration\", \"ui_url_protocol\")\n    if protocol == \"https\":\n        if not conf.has_option(\"configuration\", \"ssl_cert\"):\n            raise Exception(\n                \"Error: The protocol is https but attribute ssl_cert is not set\")\n        cert_path = conf.get(\"configuration\", \"ssl_cert\")\n        if not os.path.isfile(cert_path):\n            raise Exception(\n                \"Error: The path for certificate: %s is invalid\" % cert_path)\n        if not conf.has_option(\"configuration\", \"ssl_cert_key\"):\n            raise Exception(\n                \"Error: The protocol is https but attribute ssl_cert_key is not set\")\n        cert_key_path = conf.get(\"configuration\", \"ssl_cert_key\")\n        if not os.path.isfile(cert_key_path):\n            raise Exception(\n                \"Error: The path for certificate key: %s is invalid\" % cert_key_path)\n\n    # Storage validate\n    valid_storage_drivers = [\"filesystem\",\n                             \"azure\", \"gcs\", \"s3\", \"swift\", \"oss\"]\n    storage_provider_name = conf.get(\n        \"configuration\", \"registry_storage_provider_name\").strip()\n    if storage_provider_name not in valid_storage_drivers:\n        raise Exception(\"Error: storage driver %s is not supported, only the following ones are supported: %s\" % (\n            storage_provider_name, \",\".join(valid_storage_drivers)))\n\n    storage_provider_config = conf.get(\n        \"configuration\", \"registry_storage_provider_config\").strip()\n    if storage_provider_name != \"filesystem\":","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/goharbor/harbor/blob/7b2fd08cc568955cca339afeefab27372840d936/make/photon/prepare/utils/misc.py#L13-L49","documentation":"Thrown by the legacy validator in make/photon/prepare/utils/misc.py, which checks a ConfigParser-style harbor.cfg (pre-yaml configuration, still exercised by the migrator when processing old versions). When [configuration] ui_url_protocol = https but the ssl_cert_key option is absent, HTTPS cannot be configured and the validator aborts. This is the key-half of the certificate pair check (the ssl_cert branch sits just above it).","triggerScenarios":"A harbor.cfg with 'ui_url_protocol = https' where the 'ssl_cert_key =' line under [configuration] is missing or commented out. conf.has_option('configuration', 'ssl_cert_key') returns False and the raise fires.","commonSituations":"Upgrading old Harbor releases (<1.8) whose harbor.cfg switched to https without supplying both cert options; hand-merging harbor.cfg during migrations where lines got dropped.","solutions":["Add 'ssl_cert_key = /path/to/server.key' under [configuration] in harbor.cfg pointing at the private key on the host","Set the matching 'ssl_cert = /path/to/server.crt' as well","Or set 'ui_url_protocol = http' if https is not actually wanted (insecure)","Preferably migrate to harbor.yml (Harbor >= 1.8) and use https.certificate / https.private_key"],"exampleFix":"# harbor.cfg (before)\n[configuration]\nui_url_protocol = https\nssl_cert = /data/cert/server.crt\n# ssl_cert_key missing\n\n# harbor.cfg (after)\n[configuration]\nui_url_protocol = https\nssl_cert = /data/cert/server.crt\nssl_cert_key = /data/cert/server.key","handlingStrategy":"validation","validationCode":"import configparser\nconf = configparser.ConfigParser()\nconf.read('harbor.cfg')\nif conf.get('configuration', 'ui_url_protocol') == 'https':\n    for opt in ('ssl_cert', 'ssl_cert_key'):\n        if not conf.has_option('configuration', opt):\n            raise SystemExit('harbor.cfg: %s is required when ui_url_protocol = https' % opt)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["ui_url_protocol = https requires both ssl_cert and ssl_cert_key in harbor.cfg","When hand-merging old configs, diff against the shipped template for missing keys","Move to harbor.yml on Harbor >= 1.8 to get clearer yaml validation"],"tags":["harbor","https","tls","private-key","legacy-config"],"backgroundTag":null,"analyzedSha":"7b2fd08cc568955cca339afeefab27372840d936","analyzedAt":"2026-08-16T00:00:10.961Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}