{"record":{"id":"554590c286975c7a","repo":"coredns/coredns","slug":"maximum-of-three-arguments-allowed-for-tls-config","errorCode":null,"errorMessage":"maximum of three arguments allowed for TLS config, found %d","messagePattern":"maximum of three arguments allowed for TLS config, found (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugin/pkg/tls/tls.go","lineNumber":74,"sourceCode":"\t}\n\tif len(args) > 2 {\n\t\tcaPath = args[2]\n\t}\n\tswitch len(args) {\n\tcase 0:\n\t\t// No client cert, use system CA\n\t\tc, err = NewTLSClientConfig(\"\")\n\tcase 1:\n\t\t// No client cert, use specified CA\n\t\tc, err = NewTLSClientConfig(certPath)\n\tcase 2:\n\t\t// Client cert, use system CA\n\t\tc, err = NewTLSConfig(certPath, keyPath, \"\")\n\tcase 3:\n\t\t// Client cert, use specified CA\n\t\tc, err = NewTLSConfig(certPath, keyPath, caPath)\n\tdefault:\n\t\terr = fmt.Errorf(\"maximum of three arguments allowed for TLS config, found %d\", len(args))\n\t}\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn c, nil\n}\n\n// NewTLSConfig returns a TLS config that includes a certificate\n// Use for server TLS config or when using a client certificate\n// If caPath is empty, system CAs will be used\nfunc NewTLSConfig(certPath, keyPath, caPath string) (*tls.Config, error) {\n\tcert, err := tls.LoadX509KeyPair(certPath, keyPath)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"could not load TLS cert: %s\", err)\n\t}\n\n\troots, err := loadRoots(caPath)\n\tif err != nil {","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/coredns/coredns/blob/558c9757a92b361e550bdba82d0b4ddf3d12d595/plugin/pkg/tls/tls.go#L56-L92","documentation":"NewTLSConfigFromArgs builds a *tls.Config from a variadic argument list that normally comes straight from a Corefile TLS directive. It supports 0-3 arguments (client-cert+key+CA); any call with more than three arguments hits the default branch and returns this error. It is a guard against misconfigured argument arity, thrown before any file I/O happens.","triggerScenarios":"Calling NewTLSConfigFromArgs with four or more string arguments, e.g. NewTLSConfigFromArgs(cert, key, ca, extra) — typically from parseManualTLS or a plugin constructor (newEtcdPlugin) whose Corefile TLS directive was given too many tokens.","commonSituations":"A Corefile 'tls' clause that lists cert, key, CA plus a stray trailing token (typo, duplicated path, or extra field not supported by this coredns version); programmatic callers appending an argument beyond the documented 0-3 forms.","solutions":["Reduce the arguments to at most three: cert path, key path, CA path (or fewer, per the documented 0/1/2/3-arg forms)","Fix the Corefile TLS directive to match the supported syntax, e.g. 'tls CERT KEY CA' with no extra tokens","If an extra option is genuinely needed, check whether the running CoreDNS version supports it or use a different plugin directive"],"exampleFix":"// before\nconf := \"tls /etc/coredns/cert.pem /etc/coredns/key.pem /etc/coredns/ca.pem extra\"\n// after\nconf := \"tls /etc/coredns/cert.pem /etc/coredns/key.pem /etc/coredns/ca.pem\"","handlingStrategy":"validation","validationCode":"if len(args) > 3 {\n    return nil, fmt.Errorf(\"NewTLSConfigFromArgs: at most 3 args allowed, got %d\", len(args))\n}\nc, err := NewTLSConfigFromArgs(args...)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate Corefile TLS directive token count before constructing args","Keep the directive to the documented forms: tls, tls CA, tls CERT KEY, tls CERT KEY CA","Add a config-lint test that calls NewTLSConfigFromArgs with each deployed TLS directive"],"tags":["tls","argument-count","config"],"backgroundTag":"invalid-cli-argument","analyzedSha":"558c9757a92b361e550bdba82d0b4ddf3d12d595","analyzedAt":"2026-09-06T22:47:02.106Z","contentChangedAt":"2026-09-06T22:47:02.106Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}