{"record":{"id":"36be70ce0a56174e","repo":"elastic/elasticsearch","slug":"cannot-specify-without-also-setting","errorCode":null,"errorMessage":"cannot specify [{}] without also setting [{}]","messagePattern":"cannot specify \\[(.+?)\\] without also setting \\[(.+?)\\]","errorType":"exception","errorClass":"SslConfigException","httpStatus":null,"severity":"error","filePath":"libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfigurationLoader.java","lineNumber":389,"sourceCode":"        } else {\n            return new CompositeTrustConfig(List.of(trustConfig, trust));\n        }\n    }\n\n    public SslKeyConfig buildKeyConfig(Path basePath) {\n        final String certificatePath = stringSetting(CERTIFICATE);\n        final String keyPath = stringSetting(KEY);\n        final String keyStorePath = stringSetting(KEYSTORE_PATH);\n\n        if (certificatePath != null && keyStorePath != null) {\n            throw new SslConfigException(\n                \"cannot specify both [\" + settingPrefix + CERTIFICATE + \"] and [\" + settingPrefix + KEYSTORE_PATH + \"]\"\n            );\n        }\n\n        if (certificatePath != null || keyPath != null) {\n            if (keyPath == null) {\n                throw new SslConfigException(\n                    \"cannot specify [\" + settingPrefix + CERTIFICATE + \"] without also setting [\" + settingPrefix + KEY + \"]\"\n                );\n            }\n            if (certificatePath == null) {\n                throw new SslConfigException(\n                    \"cannot specify [\" + settingPrefix + KEY + \"] without also setting [\" + settingPrefix + CERTIFICATE + \"]\"\n                );\n            }\n            final char[] password = resolvePasswordSetting(KEY_SECURE_PASSPHRASE, KEY_LEGACY_PASSPHRASE);\n            return new PemKeyConfig(certificatePath, keyPath, password, basePath);\n        }\n\n        if (keyStorePath != null) {\n            final char[] storePassword = resolvePasswordSetting(KEYSTORE_SECURE_PASSWORD, KEYSTORE_LEGACY_PASSWORD);\n            char[] keyPassword = resolvePasswordSetting(KEYSTORE_SECURE_KEY_PASSWORD, KEYSTORE_LEGACY_KEY_PASSWORD);\n            if (keyPassword.length == 0) {\n                keyPassword = storePassword;\n            }","sourceCodeStart":371,"sourceCodeEnd":407,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfigurationLoader.java#L371-L407","documentation":"buildKeyConfig requires that PEM key material be specified as a pair: ssl.certificate AND ssl.key. Specifying only ssl.certificate means the public cert is present but the private key is missing, so the key manager cannot be built.","triggerScenarios":"ssl.certificate is set but ssl.key is not, under the same prefix (and ssl.keystore.path is not set as an alternative).","commonSituations":"Operator sets only the certificate path expecting the key to be auto-discovered; copy-paste that dropped the key line; secret-management system that injects only the cert.","solutions":["Add the matching ssl.key setting pointing to the PEM private key for the certificate.","If you intended to use a keystore instead, remove ssl.certificate and set ssl.keystore.path.","Validate that the key matches the cert (openssl x509/pkey modulus compare) after adding it."],"exampleFix":"# before\nxpack.security.http.ssl.certificate: \"node.crt\"\n# after\nxpack.security.http.ssl.certificate: \"node.crt\"\nxpack.security.http.ssl.key: \"node.key\"","handlingStrategy":"validation","validationCode":"void requirePemPair(Map<String,String> settings, String prefix) {\n    boolean hasCert = settings.containsKey(prefix + \"certificate\");\n    boolean hasKey  = settings.containsKey(prefix + \"key\");\n    if (hasCert && !hasKey)\n        throw new IllegalArgumentException(prefix + \"certificate requires \" + prefix + \"key\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always treat ssl.certificate and ssl.key as a pair in templates.","Use a config schema that requires both or neither.","Lint for orphan certificate keys in CI."],"tags":["ssl","config","pem","key","validation"],"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-12T06:17:24.410Z"}