{"record":{"id":"45ee2fa936de938f","repo":"fatedier/frp","slug":"create-vhost-httpsmuxer-error-v","errorCode":null,"errorMessage":"create vhost httpsMuxer error, %v","messagePattern":"create vhost httpsMuxer error, (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"server/service.go","lineNumber":344,"sourceCode":"\t}\n\n\t// Create https vhost muxer.\n\tif cfg.VhostHTTPSPort > 0 {\n\t\tvar l net.Listener\n\t\tif httpsMuxOn {\n\t\t\tl = svr.muxer.ListenHTTPS(1)\n\t\t} else {\n\t\t\taddress := net.JoinHostPort(cfg.ProxyBindAddr, strconv.Itoa(cfg.VhostHTTPSPort))\n\t\t\tl, err = net.Listen(\"tcp\", address)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"create server listener error, %v\", err)\n\t\t\t}\n\t\t\tlog.Infof(\"https service listen on %s\", address)\n\t\t}\n\n\t\tsvr.rc.VhostHTTPSMuxer, err = vhost.NewHTTPSMuxer(l, vhostReadWriteTimeout)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"create vhost httpsMuxer error, %v\", err)\n\t\t}\n\n\t\t// Init HTTPS group controller after HTTPSMuxer is created\n\t\tsvr.rc.HTTPSGroupCtl = group.NewHTTPSGroupController(svr.rc.VhostHTTPSMuxer)\n\t}\n\n\t// frp tls listener\n\tsvr.tlsListener = svr.muxer.Listen(2, 1, func(data []byte) bool {\n\t\t// tls first byte can be 0x16 only when vhost https port is not same with bind port\n\t\treturn int(data[0]) == netpkg.FRPTLSHeadByte || int(data[0]) == 0x16\n\t})\n\n\t// Create nat hole controller.\n\tnc, err := nathole.NewController(time.Duration(cfg.NatHoleAnalysisDataReserveHours) * time.Hour)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"create nat hole controller error, %v\", err)\n\t}\n\tsvr.rc.NatHoleController = nc","sourceCodeStart":326,"sourceCodeEnd":362,"githubUrl":"https://github.com/fatedier/frp/blob/6c8a8d0a97d03b44e9528d30b30c70cb9d61b405/server/service.go#L326-L362","documentation":"After the HTTPS port is bound, frps wraps the listener with vhost.NewHTTPSMuxer; a constructor failure aborts startup. As with the httpconnect muxer case, this is an internal setup failure on an already-valid listener and is rarely seen in stock deployments.","triggerScenarios":"NewHTTPSMuxer failing during its internal initialization immediately after a successful net.Listen.","commonSituations":"Resource pressure at boot (fd limits), forks with modified vhost internals; essentially never triggered by user config.","solutions":["Retry starting frps; if persistent, extract the wrapped %v cause and fix that","Raise file-descriptor limits on the host","Disable vhostHTTPSPort if HTTPS vhost routing is not required"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := newService(cfg); err != nil && strings.Contains(err.Error(), \"create vhost httpsMuxer error\") {\n    // internal init failure after successful bind: supervised single retry, then report\n}","preventionTips":["Set generous fd limits for frps in systemd (LimitNOFILE)","If HTTPS vhost routing is unused, omit vhostHTTPSPort entirely"],"tags":["frps","startup","vhost","internal"],"backgroundTag":null,"analyzedSha":"6c8a8d0a97d03b44e9528d30b30c70cb9d61b405","analyzedAt":"2026-08-15T06:53:27.215Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}