{"record":{"id":"51cca50dc0d592af","repo":"EpicGames/lore","slug":"label-requires-mtls-to-start-verify-client-certs-true","errorCode":null,"errorMessage":"{label} requires mTLS to start (verify_client_certs = true). Configure certificate.cert_file, certificate.pkey_file, and certificate.cert_chain, or set verify_client_certs = false to explicitly accept the security exposure","messagePattern":"(.+?) requires mTLS to start \\(verify_client_certs = true\\)\\. Configure certificate\\.cert_file, certificate\\.pkey_file, and certificate\\.cert_chain, or set verify_client_certs = false to explicitly accept the security exposure","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"lore-server/src/server.rs","lineNumber":572,"sourceCode":"/// - `Err` when `verify_client_certs = true` but the certificate is\n///   missing or only partially configured.\nfn validate_endpoint_security(\n    label: &str,\n    certificate: Option<&crate::tls::CertificateSettings>,\n    verify_client_certs: bool,\n) -> Result<EndpointSecurity> {\n    if !verify_client_certs {\n        return Ok(EndpointSecurity::Untrusted);\n    }\n    match certificate {\n        Some(cert) if cert.cert_chain.is_some() => Ok(EndpointSecurity::Mtls),\n        Some(_) => Err(anyhow!(\n            \"{label} certificate is partially configured: \\\n             certificate.cert_file and certificate.pkey_file are set but \\\n             certificate.cert_chain (the CA used to verify client certs) \\\n             is missing. The endpoint requires mTLS, not server-only TLS\"\n        )),\n        None => Err(anyhow!(\n            \"{label} requires mTLS to start (verify_client_certs = true). \\\n             Configure certificate.cert_file, certificate.pkey_file, and \\\n             certificate.cert_chain, or set verify_client_certs = false \\\n             to explicitly accept the security exposure\"\n        )),\n    }\n}\n\n#[allow(clippy::too_many_arguments)]\nasync fn launch_grpc_internal_server(\n    settings: Settings,\n    user_agent_filter: Arc<UserAgentFilter>,\n    immutable_store: Arc<dyn ImmutableStore>,\n    mutable_store: Arc<dyn MutableStore>,\n    notification_sender: Arc<dyn NotificationSender>,\n    hook_dispatcher: Arc<HookDispatcher>,\n    mut shutdown_rx: tokio::sync::watch::Receiver<bool>,\n) -> Result<()> {","sourceCodeStart":554,"sourceCodeEnd":590,"githubUrl":"https://github.com/EpicGames/lore/blob/074eb0b0d1194c997d7cf28b55519e3e197b3e23/lore-server/src/server.rs#L554-L590","documentation":"Thrown by validate_endpoint_security when verify_client_certs is true but no certificate configuration exists at all. An endpoint that must verify client certs needs a full mTLS triple (cert_file, pkey_file, cert_chain); the server refuses to start so the operator must either supply the triple or explicitly opt out.","triggerScenarios":"validate_endpoint_security called with verify_client_certs=true and certificate = None.","commonSituations":"Fresh deployment where [server.certificate] was never added but verify_client_certs = true was copied in; config template with verify enabled by default; operator forgot to configure any TLS material.","solutions":["Configure certificate.cert_file, certificate.pkey_file, and certificate.cert_chain for the endpoint.","If the exposure is acceptable, set verify_client_certs = false to explicitly disable mTLS.","Confirm the config file section names match the current Settings schema."],"exampleFix":"# before\n[server]\nverify_client_certs = true\n\n# after\n[server]\nverify_client_certs = true\n[server.certificate]\ncert_file = \"server.crt\"\npkey_file = \"server.key\"\ncert_chain = \"ca.crt\"","handlingStrategy":"validation","validationCode":"if verify_client_certs && certificate.is_none() {\n    return Err(anyhow!(\"verify_client_certs=true but no [server.certificate] configured\"));\n}","typeGuard":"fn mtls_ready(verify: bool, cert: &Option<Certificate>) -> bool {\n    !verify || matches!(cert, Some(c) if c.cert_chain.is_some())\n}","tryCatchPattern":null,"preventionTips":["Never enable verify_client_certs without a complete certificate block in the same config.","Run a pre-start config validation that checks the mTLS triple when verification is on.","Document that disabling verification is an explicit security opt-out."],"tags":["mtls","tls","configuration","security"],"backgroundTag":"missing-required-config","analyzedSha":"074eb0b0d1194c997d7cf28b55519e3e197b3e23","analyzedAt":"2026-09-13T09:00:57.509Z","contentChangedAt":"2026-09-13T09:00:57.509Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}