{"record":{"id":"59de0e03f1176e1d","repo":"joewalnes/websocketd","slug":"you-should-not-be-using-ssl-flags-when-there-is","errorCode":null,"errorMessage":"you should not be using --ssl* flags when there is no --ssl option","messagePattern":"you should not be using --ssl\\* flags when there is no --ssl option","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"config.go","lineNumber":141,"sourceCode":"\n// wantsUnixSocketOnly reports whether the user asked to serve exclusively\n// over a Unix domain socket, with no TCP listener at all. This holds only\n// when --unixsocket is given and nothing else implies a TCP listener is\n// wanted (--port, --address, or --redirport); otherwise the Unix socket\n// (if any) is served alongside the usual TCP listener(s).\nfunc wantsUnixSocketOnly(unixSocket string, portFlag int, addrlist []string, redirPort int) bool {\n\treturn unixSocket != \"\" && portFlag == 0 && len(addrlist) == 0 && redirPort == 0\n}\n\n// validateSSL checks that SSL-related flags are consistent.\nfunc validateSSL(ssl bool, certFile, keyFile string) error {\n\tif ssl {\n\t\tif certFile == \"\" || keyFile == \"\" {\n\t\t\treturn fmt.Errorf(\"please specify both --sslcert and --sslkey when requesting --ssl\")\n\t\t}\n\t} else {\n\t\tif certFile != \"\" || keyFile != \"\" {\n\t\t\treturn fmt.Errorf(\"you should not be using --ssl* flags when there is no --ssl option\")\n\t\t}\n\t}\n\treturn nil\n}\n\n// validateBinaryPassStderr checks that --binary and --passstderr aren't both\n// set. Tagging binary chunks as JSON isn't implemented (--passstderr always\n// reads line by line), so combining the two would silently discard --binary\n// instead of behaving as either flag alone.\nfunc validateBinaryPassStderr(binary, passStderr bool) error {\n\tif binary && passStderr {\n\t\treturn fmt.Errorf(\"please only specify one of --binary and --passstderr\")\n\t}\n\treturn nil\n}\n\n// validateAnyOrigin checks that --anyorigin is not combined with an actual\n// origin policy. The flags say opposite things, and silently preferring one","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/joewalnes/websocketd/blob/7a8683dc7f9778dc615945aaed2a8dc77290227b/config.go#L123-L159","documentation":"validateSSL rejects --sslcert/--sslkey given without --ssl. Supplying TLS material while TLS is disabled almost always signals a misconfiguration, so the server refuses to start rather than silently ignoring the flags.","triggerScenarios":"Running websocketd with --sslcert and/or --sslkey while --ssl is absent (ssl==false and at least one file path is set).","commonSituations":"Removing --ssl to debug plaintext issues but leaving cert flags behind; a wrapper script that always appends --ssl* flags; typo'd flag such as --ss instead of --ssl going unnoticed.","solutions":["Add --ssl to actually enable TLS with the given cert/key","Remove the --sslcert/--sslkey flags if plaintext is intended","Check for typoed flag names (e.g. --ss) that leave --ssl unset"],"exampleFix":"// before\nwebsocketd --sslcert=cert.pem --sslkey=key.pem --port=8080 ./script.sh\n// after\nwebsocketd --ssl --sslcert=cert.pem --sslkey=key.pem --port=8080 ./script.sh","handlingStrategy":"validation","validationCode":"if (!useTLS && (certPath || keyPath)) throw new Error('ssl cert/key given without --ssl');","typeGuard":"const sslFlagsConsistent = (c) => c.ssl === Boolean(c.sslcert || c.sslkey);","tryCatchPattern":"try { startServer(args) } catch (e) { if (/no --ssl option/.test(e)) console.error('either add --ssl or remove --sslcert/--sslkey'); throw e; }","preventionTips":["Keep TLS flags grouped in one config variable so they are added/removed together","Check for typos like --ss that silently leave --ssl unset","Diff your command line against a known-good template after edits"],"tags":["cli","tls","config-validation"],"backgroundTag":"inconsistent-tls-flags","analyzedSha":"7a8683dc7f9778dc615945aaed2a8dc77290227b","analyzedAt":"2026-09-03T13:52:22.309Z","contentChangedAt":"2026-09-03T13:52:22.309Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}