{"record":{"id":"46767bc6effddc25","repo":"joewalnes/websocketd","slug":"please-specify-both-sslcert-and-sslkey-when-re","errorCode":null,"errorMessage":"please specify both --sslcert and --sslkey when requesting --ssl","messagePattern":"please specify both --sslcert and --sslkey when requesting --ssl","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config.go","lineNumber":137,"sourceCode":"\t\treturn 443\n\t}\n\treturn 80\n}\n\n// wantsUnixSocketOnly reports whether the user asked to serve exclusively\n// over a Unix domain socket, with no TCP listener at all. This holds only\n// when --unixsocket is given and nothing else implies a TCP listener is\n// wanted (--port, --address, or --redirport); otherwise the Unix socket\n// (if any) is served alongside the usual TCP listener(s).\nfunc wantsUnixSocketOnly(unixSocket string, portFlag int, addrlist []string, redirPort int) bool {\n\treturn unixSocket != \"\" && portFlag == 0 && len(addrlist) == 0 && redirPort == 0\n}\n\n// validateSSL checks that SSL-related flags are consistent.\nfunc validateSSL(ssl bool, certFile, keyFile string) error {\n\tif ssl {\n\t\tif certFile == \"\" || keyFile == \"\" {\n\t\t\treturn fmt.Errorf(\"please specify both --sslcert and --sslkey when requesting --ssl\")\n\t\t}\n\t} else {\n\t\tif certFile != \"\" || keyFile != \"\" {\n\t\t\treturn fmt.Errorf(\"you should not be using --ssl* flags when there is no --ssl option\")\n\t\t}\n\t}\n\treturn nil\n}\n\n// validateBinaryPassStderr checks that --binary and --passstderr aren't both\n// set. Tagging binary chunks as JSON isn't implemented (--passstderr always\n// reads line by line), so combining the two would silently discard --binary\n// instead of behaving as either flag alone.\nfunc validateBinaryPassStderr(binary, passStderr bool) error {\n\tif binary && passStderr {\n\t\treturn fmt.Errorf(\"please only specify one of --binary and --passstderr\")\n\t}\n\treturn nil","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/joewalnes/websocketd/blob/7a8683dc7f9778dc615945aaed2a8dc77290227b/config.go#L119-L155","documentation":"validateSSL enforces that when --ssl is requested, both the certificate and key files must be provided. Enabling TLS with only one of them leaves the listener unconfigurable, so startup fails with this message.","triggerScenarios":"Running websocketd with --ssl but omitting --sslcert, --sslkey, or both, i.e. ssl==true while certFile or keyFile is an empty string.","commonSituations":"Enabling --ssl during local testing without generating cert/key; forgetting the key path when cert and key live in different directories; config migration dropping one flag.","solutions":["Pass both flags: --ssl --sslcert /path/cert.pem --sslkey /path/key.pem","Generate a self-signed pair for testing, e.g. openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem","Remove --ssl if you actually want plain HTTP/WS"],"exampleFix":"// before\nwebsocketd --ssl --port=443 ./script.sh\n// after\nwebsocketd --ssl --sslcert=cert.pem --sslkey=key.pem --port=443 ./script.sh","handlingStrategy":"validation","validationCode":"if (useTLS && (!certPath || !keyPath)) throw new Error('--ssl requires both --sslcert and --sslkey');","typeGuard":"const sslConfigOk = (c) => !c.ssl || (Boolean(c.sslcert) && Boolean(c.sslkey));","tryCatchPattern":"try { startServer(cfg) } catch (e) { if (/sslcert and --sslkey/.test(e)) console.error('supply both cert and key or drop --ssl'); throw e; }","preventionTips":["Generate cert+key together with openssl and store both paths in your deploy config","Validate the full flag set in your launch script before exec'ing websocketd"],"tags":["cli","tls","config-validation"],"backgroundTag":"missing-tls-cert-or-key","analyzedSha":"7a8683dc7f9778dc615945aaed2a8dc77290227b","analyzedAt":"2026-09-03T13:52:22.309Z","contentChangedAt":"2026-09-03T13:52:22.309Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}