{"record":{"id":"4bfb7f7475ce345b","repo":"rathole-org/rathole","slug":"missing-tls-configuration","errorCode":null,"errorMessage":"Missing TLS configuration","messagePattern":"Missing TLS configuration","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/config.rs","lineNumber":311,"sourceCode":"    }\n\n    fn validate_transport_config(config: &TransportConfig, is_server: bool) -> Result<()> {\n        config\n            .tcp\n            .proxy\n            .as_ref()\n            .map_or(Ok(()), |u| match u.scheme() {\n                \"socks5\" => Ok(()),\n                \"http\" => Ok(()),\n                _ => Err(anyhow!(format!(\"Unknown proxy scheme: {}\", u.scheme()))),\n            })?;\n        match config.transport_type {\n            TransportType::Tcp => Ok(()),\n            TransportType::Tls => {\n                let tls_config = config\n                    .tls\n                    .as_ref()\n                    .ok_or_else(|| anyhow!(\"Missing TLS configuration\"))?;\n                if is_server {\n                    tls_config\n                        .pkcs12\n                        .as_ref()\n                        .and(tls_config.pkcs12_password.as_ref())\n                        .ok_or_else(|| anyhow!(\"Missing `pkcs12` or `pkcs12_password`\"))?;\n                }\n                Ok(())\n            }\n            TransportType::Noise => {\n                // The check is done in transport\n                Ok(())\n            }\n            TransportType::Websocket => Ok(()),\n        }\n    }\n\n    pub async fn from_file(path: &Path) -> Result<Config> {","sourceCodeStart":293,"sourceCodeEnd":329,"githubUrl":"https://github.com/rathole-org/rathole/blob/a292f7ed5402f840415fc6a53827da2f34337856/src/config.rs#L293-L329","documentation":"`transport_type = \"tls\"` was selected but the `[transport.tls]` section is absent from the config. The validator requires TLS settings whenever the TLS transport is chosen and fails fast with this error instead of failing later at connection time.","triggerScenarios":"Running with a config where `[transport]` has `type = \"tls\"` (or transport_type is set to TLS) but no `[transport.tls]` table defining `pkcs12`/`pkcs12_password` (server) or `tls_hostname`/`accept_invalid_certs` (client).","commonSituations":"Users switch the transport type from tcp to tls and forget to add the tls block; configs copied from a tcp example; a misnamed section like `[tls]` at the wrong nesting level so it isn't deserialized into `config.tls`.","solutions":["Add a `[transport.tls]` section with the required settings","On the server add `pkcs12` (path to a .p12/.pkcs12 certificate) and `pkcs12_password`","On the client set `tls_hostname` (and optionally `accept_invalid_certs` for self-signed certs)","Check the section is nested correctly as `[transport.tls]`, not a top-level `[tls]` table"],"exampleFix":"# before\n[transport]\ntype = \"tls\"\n\n# after\n[transport]\ntype = \"tls\"\n\n[transport.tls]\ntls_hostname = \"example.com\"","handlingStrategy":"validation","validationCode":"let raw: toml::Value = toml::from_str(&cfg)?;\nlet ttype = raw[\"transport\"][\"type\"].as_str().unwrap_or(\"tcp\");\nif ttype == \"tls\" && raw[\"transport\"][\"tls\"].is_none() {\n    return Err(\"transport.type = tls requires a [transport.tls] section\".into());\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["When switching transport type, update the matching transport section in the same change","Keep client and server TLS sections in their respective role configs","Test the config locally before deploying to the server"],"tags":["config","tls","validation"],"backgroundTag":"missing-required-config-field","analyzedSha":"a292f7ed5402f840415fc6a53827da2f34337856","analyzedAt":"2026-09-07T09:56:55.739Z","contentChangedAt":"2026-09-07T09:56:55.739Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}