{"record":{"id":"42a628914dd1a408","repo":"alibaba/nacos","slug":"enable-mutual-auth-trustcollectioncertfile-must-be","errorCode":null,"errorMessage":"enable mutual auth,trustCollectionCertFile must be not null","messagePattern":"enable mutual auth,trustCollectionCertFile must be not null","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/com/alibaba/nacos/core/remote/grpc/negotiator/tls/DefaultTlsContextBuilder.java","lineNumber":78,"sourceCode":"            SslContextBuilder sslClientContextBuilder = SslContextBuilder\n                .forServer(certificateChainFile, privateKeyFile,\n                    rpcServerTlsConfig.getCertPrivateKeyPassword());\n            \n            if (StringUtils.isNotBlank(rpcServerTlsConfig.getProtocols())) {\n                sslClientContextBuilder.protocols(rpcServerTlsConfig.getProtocols().split(\",\"));\n            }\n            \n            if (StringUtils.isNotBlank(rpcServerTlsConfig.getCiphers())) {\n                sslClientContextBuilder\n                    .ciphers(Arrays.asList(rpcServerTlsConfig.getCiphers().split(\",\")));\n            }\n            if (rpcServerTlsConfig.getMutualAuthEnable()) {\n                // trust all certificate\n                if (rpcServerTlsConfig.getTrustAll()) {\n                    sslClientContextBuilder.trustManager(InsecureTrustManagerFactory.INSTANCE);\n                } else {\n                    if (StringUtils.isBlank(rpcServerTlsConfig.getTrustCollectionCertFile())) {\n                        throw new IllegalArgumentException(\n                            \"enable mutual auth,trustCollectionCertFile must be not null\");\n                    }\n                    \n                    InputStream clientCert =\n                        getInputStream(rpcServerTlsConfig.getTrustCollectionCertFile(),\n                            \"trustCollectionCertFile\");\n                    sslClientContextBuilder.trustManager(clientCert);\n                }\n                sslClientContextBuilder.clientAuth(ClientAuth.REQUIRE);\n            }\n            SslContextBuilder configure = GrpcSslContexts.configure(sslClientContextBuilder,\n                TlsTypeResolve.getSslProvider(rpcServerTlsConfig.getSslProvider()));\n            return configure.build();\n        } catch (SSLException e) {\n            Loggers.REMOTE.info(\"Nacos Rpc server reload ssl context fail tls config:{}\",\n                JacksonUtils.toJson(rpcServerTlsConfig));\n            throw new NacosRuntimeException(NacosException.SERVER_ERROR, e);\n        }","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/core/src/main/java/com/alibaba/nacos/core/remote/grpc/negotiator/tls/DefaultTlsContextBuilder.java#L60-L96","documentation":"Error \"enable mutual auth,trustCollectionCertFile must be not null\" thrown in alibaba/nacos.","triggerScenarios":"Thrown at core/src/main/java/com/alibaba/nacos/core/remote/grpc/negotiator/tls/DefaultTlsContextBuilder.java:78 when the library encounters an invalid state.","commonSituations":"Enabling mutual TLS without a trustCollectionCertFile.","solutions":["Correct the invalid value for mutual TLS trust cert missing to match the expected format or allowed set, then retry."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}