{"record":{"id":"4e128737e0037c05","repo":"jax-ml/jax","slug":"mtls-for-the-jax-distributed-service-requires-jaxl","errorCode":null,"errorMessage":"mTLS for the JAX distributed service requires jaxlib 0.11.2 or newer.","messagePattern":"mTLS for the JAX distributed service requires jaxlib 0\\.11\\.2 or newer\\.","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"jax/_src/distributed.py","lineNumber":84,"sourceCode":"\n  kwargs: dict[str, Any] = dict(\n      mtls_cert_file=value_or_config(\n          mtls_cert_file, config.mtls_cert_file),\n      mtls_key_file=value_or_config(\n          mtls_key_file, config.mtls_key_file),\n      mtls_ca_file=value_or_config(\n          mtls_ca_file, config.mtls_ca_file),\n      mtls_peer_uri_prefix=value_or_config(\n          mtls_peer_uri_prefix, config.mtls_peer_uri_prefix),\n      verify_secure_credentials=value_or_config(\n          verify_secure_credentials,\n          config.distributed_verify_secure_credentials),\n  )\n  if jaxlib_extension_version < 483:\n    verify_secure_credentials = kwargs.pop('verify_secure_credentials')\n    if (verify_secure_credentials\n        or any(v is not None for v in kwargs.values())):\n      raise RuntimeError('mTLS for the JAX distributed service requires '\n                         'jaxlib 0.11.2 or newer.')\n    return {}\n  return kwargs\n\n\nclass State:\n  process_id: int = 0\n  num_processes: int = 1\n  service: _jax.DistributedRuntimeService | Any | None = None\n  client: _jax.DistributedRuntimeClient | Any | None = None\n  preemption_sync_manager: Any | None = None\n  coordinator_address: str | None = None\n  partition_index: int | None = None\n\n  def initialize(self,\n                 coordinator_address: str | None = None,\n                 num_processes: int | None = None,\n                 process_id: int | None = None,","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/jax-ml/jax/blob/1e1c6a8fc06dfcd1247076ec5cae4640cea5d7bb/jax/_src/distributed.py#L66-L102","documentation":"The distributed service's mTLS options (cert/key/CA files, verify_secure_credentials) only exist in jaxlib >= 0.11.2 (extension version >= 483). Requesting any of them on an older jaxlib raises this RuntimeError from _get_mtls_kwargs during jax.distributed.initialize.","triggerScenarios":"Calling jax.distributed.initialize with mtls_cert_file/mtls_key_file/mtls_ca_file or verify_secure_credentials=True while the installed jaxlib extension version is below 483.","commonSituations":"Pinning old jaxlib in requirements while using new jax; installing jax via a stale pip environment or older CUDA wheel; security-hardened clusters requiring mTLS with an outdated toolchain.","solutions":["Upgrade jaxlib (and jax) to >= 0.11.2: pip install -U jax jaxlib","If you cannot upgrade, omit all mTLS kwargs and verify_secure_credentials and use plain TCP for the coordinator","Verify versions: python -c \"import jaxlib; print(jaxlib.__version__)\" and check extension version >= 483"],"exampleFix":"# before (old jaxlib)\njax.distributed.initialize(..., mtls_cert_file='c.pem', mtls_key_file='k.pem')\n# after\npip install -U \"jax[cpu]>=0.11.2\" \"jaxlib>=0.11.2\"\njax.distributed.initialize(..., mtls_cert_file='c.pem', mtls_key_file='k.pem')","handlingStrategy":"validation","validationCode":"from jaxlib import extension_version if False else None\nimport jax._src.lib as jlib\nMTLS_OK = jlib.jaxlib_extension_version >= 483\nassert MTLS_OK or not any([cert, key, ca, verify]), 'jaxlib too old for mTLS'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin jax/jaxlib >= 0.11.2 when using mTLS","Check jaxlib extension version in CI for distributed features"],"tags":["jax","distributed","mtls","version-mismatch"],"backgroundTag":"library-version-too-old","analyzedSha":"1e1c6a8fc06dfcd1247076ec5cae4640cea5d7bb","analyzedAt":"2026-08-27T09:53:25.647Z","schemaVersion":2},"datasetVersion":"2026-08-27T13:17:12.746Z"}