{"record":{"id":"4cdb19c8a90bae3c","repo":"sgl-project/sglang","slug":"ssl-ca-certificates-file-not-found-cfg-ssl-ca-c","errorCode":null,"errorMessage":"SSL CA certificates file not found: '{cfg.ssl_ca_certs}'. Please check the --ssl-ca-certs path.","messagePattern":"SSL CA certificates file not found: '(.+?)'\\. Please check the --ssl-ca-certs path\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"python/sglang/srt/server_args.py","lineNumber":4338,"sourceCode":"                    \"--ssl-ca-certs has no effect without --ssl-certfile and --ssl-keyfile.\"\n                )\n            if cfg.ssl_keyfile_password:\n                raise ValueError(\n                    \"--ssl-keyfile-password has no effect without --ssl-certfile and --ssl-keyfile.\"\n                )\n        # Validate files exist early to avoid late failures after model loading.\n        if cfg.ssl_keyfile and not os.path.isfile(cfg.ssl_keyfile):\n            raise ValueError(\n                f\"SSL key file not found: '{cfg.ssl_keyfile}'. \"\n                f\"Please check the --ssl-keyfile path.\"\n            )\n        if cfg.ssl_certfile and not os.path.isfile(cfg.ssl_certfile):\n            raise ValueError(\n                f\"SSL certificate file not found: '{cfg.ssl_certfile}'. \"\n                f\"Please check the --ssl-certfile path.\"\n            )\n        if cfg.ssl_ca_certs and not os.path.isfile(cfg.ssl_ca_certs):\n            raise ValueError(\n                f\"SSL CA certificates file not found: '{cfg.ssl_ca_certs}'. \"\n                f\"Please check the --ssl-ca-certs path.\"\n            )\n        if cfg.enable_ssl_refresh and not (cfg.ssl_certfile and cfg.ssl_keyfile):\n            raise ValueError(\n                \"--enable-ssl-refresh requires --ssl-certfile and --ssl-keyfile \"\n                \"to be specified.\"\n            )\n\n        if cfg.enable_http2:\n            if not 0 < cfg.http2_max_concurrent_streams < 2**32:\n                raise ValueError(\n                    \"--http2-max-concurrent-streams must be between 1 and \"\n                    \"4294967295.\"\n                )\n\n            try:\n                import granian  # noqa: F401","sourceCodeStart":4320,"sourceCodeEnd":4356,"githubUrl":"https://github.com/sgl-project/sglang/blob/0132848349585cfe6aae51c4941cbae872505f8a/python/sglang/srt/server_args.py#L4320-L4356","documentation":"SGLang validates SSL-related server arguments before startup. This error is raised when --ssl-ca-certs points to a path that does not exist on disk, meaning the CA bundle used to verify client/server certificates cannot be loaded.","triggerScenarios":"Launching the server with --ssl-ca-certs /path/to/ca.pem where the file does not exist (typo, missing mount, wrong container path). Validation happens in _handle_ssl_validation during the server_args resolution pipeline, before any model loading.","commonSituations":"Docker/Kubernetes volumes not mounted at the expected path; typo in the cert path; cert file present in dev but missing in the deployment image; relative path resolved against a different working directory.","solutions":["Verify the file exists: ls -l <path> on the host/container where the server runs","Use an absolute path for --ssl-ca-certs","In containers, confirm the secret/volume is mounted and the path in args matches the mount point","If CA verification is not needed, drop --ssl-ca-certs entirely"],"exampleFix":"# before\npython -m sglang.launch_server --ssl-ca-certs certs/ca.pem\n# after\npython -m sglang.launch_server --ssl-ca-certs /etc/sglang/certs/ca.pem","handlingStrategy":"validation","validationCode":"import os\nfor p in [args.ssl_ca_certs, args.ssl_certfile, args.ssl_keyfile]:\n    if p and not os.path.isfile(p):\n        raise SystemExit(f\"missing TLS file: {p}\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always use absolute paths for TLS material","Add preflight checks (os.path.isfile) in launch scripts","Mount certs at a fixed well-known path in containers"],"tags":["ssl","tls","certificates","server-args","startup-validation"],"backgroundTag":"ssl-certificate-file-not-found","analyzedSha":"0132848349585cfe6aae51c4941cbae872505f8a","analyzedAt":"2026-08-28T05:10:05.995Z","schemaVersion":2},"datasetVersion":"2026-08-28T06:17:29.519Z"}