{"record":{"id":"304b417f8dad5b14","repo":"docker/cli","slug":"the-s-flag-requires-that-a-s-flag-and-or","errorCode":null,"errorMessage":"the --%s flag requires that a --%s flag and/or --%s flag be provided as well","messagePattern":"the --(.+?) flag requires that a --(.+?) flag and/or --(.+?) flag be provided as well","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command/swarm/ca.go","lineNumber":82,"sourceCode":"\t}\n\n\tif !opts.rotate {\n\t\tfor _, f := range []string{flagCACert, flagCAKey, flagCertExpiry, flagExternalCA} {\n\t\t\tif flags.Changed(f) {\n\t\t\t\treturn fmt.Errorf(\"`--%s` flag requires the `--rotate` flag to update the CA\", f)\n\t\t\t}\n\t\t}\n\t\treturn displayTrustRoot(dockerCLI.Out(), res)\n\t}\n\n\tif flags.Changed(flagExternalCA) && len(opts.externalCA.Value()) > 0 && !flags.Changed(flagCACert) {\n\t\treturn fmt.Errorf(\n\t\t\t\"rotating to an external CA requires the `--%s` flag to specify the external CA's cert - \"+\n\t\t\t\t\"to add an external CA with the current root CA certificate, use the `update` command instead\", flagCACert)\n\t}\n\n\tif flags.Changed(flagCACert) && len(opts.externalCA.Value()) == 0 && !flags.Changed(flagCAKey) {\n\t\treturn fmt.Errorf(\"the --%s flag requires that a --%s flag and/or --%s flag be provided as well\",\n\t\t\tflagCACert, flagCAKey, flagExternalCA)\n\t}\n\n\tupdateSwarmSpec(&res.Swarm.Spec, flags, opts)\n\tif _, err := apiClient.SwarmUpdate(ctx, client.SwarmUpdateOptions{\n\t\tVersion: res.Swarm.Version,\n\t\tSpec:    res.Swarm.Spec,\n\t}); err != nil {\n\t\treturn err\n\t}\n\n\tif opts.detach {\n\t\treturn nil\n\t}\n\treturn attach(ctx, dockerCLI, opts)\n}\n\nfunc updateSwarmSpec(spec *swarm.Spec, flags *pflag.FlagSet, opts caOptions) {","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/command/swarm/ca.go#L64-L100","documentation":"Thrown by 'docker swarm ca --rotate' when --ca-cert is given but neither --ca-key nor --external-ca is supplied. A rotation that sets a new CA certificate needs either the matching private key (to self-sign) or an external CA endpoint to sign with it.","triggerScenarios":"Running 'docker swarm ca --rotate --ca-cert ./new.pem' with neither --ca-key nor --external-ca. The guard at ca.go:81 checks flags.Changed(flagCACert) && len(opts.externalCA.Value())==0 && !flags.Changed(flagCAKey).","commonSituations":"Operator supplies only the public cert half of a CA pair; assumes --ca-cert alone regenerates a key; forgot to copy the key file path.","solutions":["Add the matching key: 'docker swarm ca --rotate --ca-cert ./new.pem --ca-key ./new-key.pem'.","Or add an external CA spec: 'docker swarm ca --rotate --ca-cert ./new.pem --external-ca protocol=cfssl,url=https://ca'.","If you want Docker to generate a brand-new CA, drop --ca-cert entirely and run 'docker swarm ca --rotate'."],"exampleFix":"# before\ndocker swarm ca --rotate --ca-cert ./new.pem\n\n# after\ndocker swarm ca --rotate --ca-cert ./new.pem --ca-key ./new-key.pem","handlingStrategy":"validation","validationCode":"// Validate: --ca-cert on rotate needs --ca-key and/or --external-ca\nif flags.Changed(flagRotate) && flags.Changed(flagCACert) && len(externalCA.Value()) == 0 && !flags.Changed(flagCAKey) {\n    return errors.New(\"--ca-cert requires --ca-key and/or --external-ca\")\n}","typeGuard":"func certProvidedWithoutSigner(flags *pflag.FlagSet, ext Value) bool {\n\treturn flags.Changed(flagCACert) && len(ext.Value()) == 0 && !flags.Changed(flagCAKey)\n}","tryCatchPattern":null,"preventionTips":["Always pair --ca-cert with --ca-key (self-sign) or --external-ca (external signer).","If generating a fresh CA, omit --ca-cert and just use --rotate.","Verify the cert and key are a matching PEM pair before running."],"tags":["swarm","ca","validation","tls"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}