{"record":{"id":"43cdf4d9654b42bd","repo":"fluent/fluentd","slug":"no-valid-cert-options-configured-specify-either","errorCode":null,"errorMessage":"no valid cert options configured. specify either 'cert_path', 'ca_cert_path' or 'insecure'","messagePattern":"no valid cert options configured\\. specify either 'cert_path', 'ca_cert_path' or 'insecure'","errorType":"exception","errorClass":"Fluent::ConfigError","httpStatus":null,"severity":"error","filePath":"lib/fluent/plugin_helper/cert_option.rb","lineNumber":92,"sourceCode":"\n        when conf.ca_cert_path\n          raise Fluent::ConfigError, \"ca_private_key_path is required when ca_cert_path is specified\" unless conf.ca_private_key_path\n          log.warn \"For security reason, setting ca_private_key_passphrase is recommended when ca_cert_path is specified\" unless conf.ca_private_key_passphrase\n          generate_opts = cert_option_cert_generation_opts_from_conf(conf)\n          cert_option_generate_server_pair_by_ca(\n            conf.ca_cert_path,\n            conf.ca_private_key_path,\n            conf.ca_private_key_passphrase,\n            generate_opts\n          )\n\n        when conf.insecure\n          log.warn \"insecure TLS communication server is configured (using 'insecure' mode)\"\n          generate_opts = cert_option_cert_generation_opts_from_conf(conf)\n          cert_option_generate_server_pair_self_signed(generate_opts)\n\n        else\n          raise Fluent::ConfigError, \"no valid cert options configured. specify either 'cert_path', 'ca_cert_path' or 'insecure'\"\n        end\n      end\n\n      def cert_option_load(cert_path, private_key_path, private_key_passphrase)\n        key = OpenSSL::PKey::read(File.read(private_key_path), private_key_passphrase)\n        certs = cert_option_certificates_from_file(cert_path)\n        cert = certs.shift\n        return cert, key, certs\n      end\n\n      def cert_option_cert_generation_opts_from_conf(conf)\n        {\n          private_key_length: conf.generate_private_key_length,\n          country: conf.generate_cert_country,\n          state: conf.generate_cert_state,\n          locality: conf.generate_cert_locality,\n          common_name: conf.generate_cert_common_name || ::Socket.gethostname,\n          expiration: conf.generate_cert_expiration,","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/fluent/fluentd/blob/dd45c6e18dc7be33b5e5a0f0767bf46307ff5626/lib/fluent/plugin_helper/cert_option.rb#L74-L110","documentation":"cert_option_server_validate! (cert_option.rb:91-93) accepts exactly one of three ways to provision server TLS material: a pre-issued certificate (cert_path + private_key_path), dynamic CA-signed generation (ca_cert_path + ca_private_key_path), or an explicitly acknowledged self-signed insecure mode (insecure true). If none is present, there is no certificate to serve TLS with, and this Fluent::ConfigError is raised at startup.","triggerScenarios":"<transport tls> enabled (via <transport tls> in a forward input, http input, etc.) with none of cert_path, ca_cert_path, or insecure set — e.g. only client_cert_auth or ca_path (CA-for-verifying-clients) configured; or an env-templated config where the cert section rendered empty.","commonSituations":"Enabling TLS incrementally: operator sets client_cert_auth true and ca_path for mutual TLS but forgets the server side; config templating (erb/helm) omitting the whole cert block when a variable is unset; assuming fluentd will generate a self-signed cert by default (it will not, unless insecure true).","solutions":["Provide a server certificate pair: cert_path + private_key_path (plus private_key_passphrase if encrypted)","Or enable dynamic CA-signed generation: ca_cert_path + ca_private_key_path","Or, for testing only, set insecure true to use a generated self-signed certificate (clients must then skip verification; it is logged with a warning)","Audit templated configs for empty variable expansion around the <transport tls> block"],"exampleFix":"# before\n<source>\n  @type forward\n  <transport tls>\n    client_cert_auth true\n    ca_path /etc/fluent/ca.pem\n  </transport>\n</source>\n# => no valid cert options configured. specify either 'cert_path', 'ca_cert_path' or 'insecure'\n\n# after\n<source>\n  @type forward\n  <transport tls>\n    cert_path /etc/fluent/server-cert.pem\n    private_key_path /etc/fluent/server-key.pem\n    client_cert_auth true\n    ca_path /etc/fluent/ca.pem\n  </transport>\n</source>","handlingStrategy":"validation","validationCode":"tls = { 'cert_path' => nil, 'ca_cert_path' => nil, 'insecure' => false } # from rendered conf\nraise 'no cert mode: set cert_path, ca_cert_path, or insecure' unless tls['cert_path'] || tls['ca_cert_path'] || tls['insecure']","typeGuard":null,"tryCatchPattern":"begin\n  agent.configure(conf)\nrescue Fluent::ConfigError => e\n  if e.message.include?('no valid cert options')\n    abort 'configure one of cert_path (+key), ca_cert_path (+ca key), or insecure (test only)'\n  end\n  raise\nend","preventionTips":["Never enable <transport tls> without planning the server certificate story; client-side ca_path verifies clients but provides no server cert","Make TLS blocks in config templates conditional: skip <transport tls> entirely when cert variables are unset, rather than emitting an empty block","Reserve insecure true for test environments and alert on it in production config audits"],"tags":["fluentd","tls","certificate","config-error","startup","server"],"backgroundTag":"tls-certificate-config-missing","analyzedSha":"dd45c6e18dc7be33b5e5a0f0767bf46307ff5626","analyzedAt":"2026-08-21T16:22:07.332Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}