{"record":{"id":"2eb720e60eeed771","repo":"microsoft/garnet","slug":"cannot-provide-sslserverauthenticationoptions-when","errorCode":null,"errorMessage":"Cannot provide SslServerAuthenticationOptions when TLS is disabled","messagePattern":"Cannot provide SslServerAuthenticationOptions when TLS is disabled","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"libs/common/Networking/NetworkHandler.cs","lineNumber":152,"sourceCode":"                transportReceiveBufferPtr = transportReceiveBufferEntry.entryPtr;\n\n                transportSendBufferEntry = this.networkPool.Get(this.networkBufferSettings.sendBufferSize, PoolEntryBufferType.TransportSendBuffer);\n                transportSendBuffer = transportSendBufferEntry.entry;\n                transportSendBufferPtr = transportSendBufferEntry.entryPtr;\n            }\n        }\n\n        /// <summary>\n        /// Begin (background) network handler.\n        /// \n        /// Blocks until auth completes.\n        /// </summary>\n        public virtual void Start(SslServerAuthenticationOptions tlsOptions = null, string remoteEndpointName = null, CancellationToken token = default)\n        {\n            if (tlsOptions != null && sslStream == null)\n                throw new Exception(\"Need to provide SslServerAuthenticationOptions when TLS is enabled\");\n            if (tlsOptions == null && sslStream != null)\n                throw new Exception(\"Cannot provide SslServerAuthenticationOptions when TLS is disabled\");\n            if (tlsOptions == null && sslStream == null) return;\n\n            // Can't use SslStream's sync methods for auth, so we must block\n            AsyncUtils.BlockingWait(AuthenticateAsServerAsync(tlsOptions, remoteEndpointName, token));\n        }\n\n        /// <summary>\n        /// Begin async network handler.\n        /// </summary>\n        public virtual async Task StartAsync(SslServerAuthenticationOptions tlsOptions = null, string remoteEndpointName = null, CancellationToken token = default)\n        {\n            if (tlsOptions != null && sslStream == null)\n                throw new Exception(\"Need to provide SslServerAuthenticationOptions when TLS is enabled\");\n            if (tlsOptions == null && sslStream != null)\n                throw new Exception(\"Cannot provide SslServerAuthenticationOptions when TLS is disabled\");\n            if (tlsOptions == null && sslStream == null) return;\n\n            await AuthenticateAsServerAsync(tlsOptions, remoteEndpointName, token).ConfigureAwait(false);","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/microsoft/garnet/blob/951b0fc6838721f89d102c2bbe1b914e8d39d700/libs/common/Networking/NetworkHandler.cs#L134-L170","documentation":"Thrown by the server-side NetworkHandler.Start when tlsOptions is null but the handler was constructed with TLS (sslStream != null). A TLS-enabled handler cannot authenticate without server auth options, so omitting them is a configuration contradiction.","triggerScenarios":"Constructing a NetworkHandler with an SslStream, then calling Start() with null tlsOptions.","commonSituations":"TLS handler created (TLS on) but the caller forgets to pass SslServerAuthenticationOptions; a config read that returns null options while the handler is TLS-capable.","solutions":["Always supply SslServerAuthenticationOptions when the handler is TLS-enabled.","Validate that a TLS-enabled handler has a non-null options object before calling Start.","Fail fast at config load if TLS is enabled but no cert/options are configured."],"exampleFix":"// before\nhandler.Start();\n// after\nhandler.Start(tlsOpts ?? throw new InvalidOperationException(\"TLS handler requires server auth options\"));","handlingStrategy":"validation","validationCode":"// Ensure a TLS-enabled handler gets non-null options\nif (handler.IsTlsEnabled && tlsOpts == null)\n    throw new InvalidOperationException(\"TLS-enabled handler requires SslServerAuthenticationOptions\");\nhandler.Start(tlsOpts, remoteEndpointName, token);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always supply SslServerAuthenticationOptions for TLS-enabled handlers.","Fail fast at config load if TLS is on but no server cert/options exist.","Keep sync and async start paths receiving the same options object."],"tags":["network","tls","server","config","garnet"],"backgroundTag":null,"analyzedSha":"951b0fc6838721f89d102c2bbe1b914e8d39d700","analyzedAt":"2026-08-13T19:01:32.939Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}