{"record":{"id":"34e5abfa579f3c9e","repo":"sgl-project/sglang","slug":"ssl-keyfile-requires-ssl-certfile-to-be-specif","errorCode":null,"errorMessage":"--ssl-keyfile requires --ssl-certfile to be specified as well.","messagePattern":"--ssl-keyfile requires --ssl-certfile to be specified as well\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"python/sglang/srt/server_args.py","lineNumber":4310,"sourceCode":"            # Default behavior:\n            # - non-PD: round_robin\n            # - PD prefill: follow_bootstrap_room\n            # - PD decode: round_robin\n            self._declare(\n                \"_handle_load_balance_method\",\n                load_balance_method=(\n                    \"follow_bootstrap_room\"\n                    if cfg.disaggregation_mode == \"prefill\"\n                    else \"round_robin\"\n                ),\n            )\n            return\n\n    def _handle_ssl_validation(self):\n        \"\"\"Ensure SSL arguments are consistent and referenced files exist.\"\"\"\n        cfg = resolving_view(self)\n        if cfg.ssl_keyfile and not cfg.ssl_certfile:\n            raise ValueError(\n                \"--ssl-keyfile requires --ssl-certfile to be specified as well.\"\n            )\n        if cfg.ssl_certfile and not cfg.ssl_keyfile:\n            raise ValueError(\n                \"--ssl-certfile requires --ssl-keyfile to be specified as well.\"\n            )\n        if not cfg.ssl_certfile and not cfg.ssl_keyfile:\n            if cfg.ssl_ca_certs:\n                raise ValueError(\n                    \"--ssl-ca-certs has no effect without --ssl-certfile and --ssl-keyfile.\"\n                )\n            if cfg.ssl_keyfile_password:\n                raise ValueError(\n                    \"--ssl-keyfile-password has no effect without --ssl-certfile and --ssl-keyfile.\"\n                )\n        # Validate files exist early to avoid late failures after model loading.\n        if cfg.ssl_keyfile and not os.path.isfile(cfg.ssl_keyfile):\n            raise ValueError(","sourceCodeStart":4292,"sourceCodeEnd":4328,"githubUrl":"https://github.com/sgl-project/sglang/blob/0132848349585cfe6aae51c4941cbae872505f8a/python/sglang/srt/server_args.py#L4292-L4328","documentation":"ServerArgs validation error raised when --ssl-keyfile is provided without --ssl-certfile. Enabling TLS on the HTTP server requires both halves of the key/certificate pair; a key alone cannot configure SSL.","triggerScenarios":"Launching with --ssl-keyfile server.key while omitting --ssl-certfile.","commonSituations":"Partial TLS configuration copied from a runbook; assuming a default cert path; flag order mangled in generated launch commands.","solutions":["Add the matching --ssl-certfile server.crt to the command","Verify both files exist and match (openssl x509 -noout -modulus vs openssl rsa -noout -modulus)"],"exampleFix":"# before\n--ssl-keyfile server.key\n# after\n--ssl-keyfile server.key --ssl-certfile server.crt","handlingStrategy":"validation","validationCode":"import os\n\ndef ssl_flags(cert: str | None, key: str | None) -> list[str]:\n    if bool(cert) != bool(key):\n        raise ValueError(\"--ssl-certfile and --ssl-keyfile must be provided together\")\n    return ([] if not cert else [\"--ssl-certfile\", cert, \"--ssl-keyfile\", key])","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always configure cert and key as an inseparable pair in your deployment manifests","Validate the pair in CI config linting before rollout"],"tags":["sglang","ssl","tls","server-config","argument-validation"],"backgroundTag":"ssl-certificate-configuration","analyzedSha":"0132848349585cfe6aae51c4941cbae872505f8a","analyzedAt":"2026-08-28T05:10:05.995Z","schemaVersion":2},"datasetVersion":"2026-08-28T06:17:29.519Z"}