{"record":{"id":"5abf6e353c7ac3e9","repo":"thanos-io/thanos","slug":"setup-grpc-server-5abf6e","errorCode":null,"errorMessage":"setup gRPC server","messagePattern":"setup gRPC server","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cmd/thanos/receive.go","lineNumber":362,"sourceCode":"\t\t\thttpserver.WithGracePeriod(time.Duration(*conf.httpGracePeriod)),\n\t\t\thttpserver.WithTLSConfig(*conf.httpTLSConfig),\n\t\t)\n\t\tg.Add(func() error {\n\t\t\tstatusProber.Healthy()\n\t\t\treturn srv.ListenAndServe()\n\t\t}, func(err error) {\n\t\t\tstatusProber.NotReady(err)\n\t\t\tdefer statusProber.NotHealthy(err)\n\n\t\t\tsrv.Shutdown(err)\n\t\t})\n\t}\n\n\tlevel.Debug(logger).Log(\"msg\", \"setting up gRPC server\")\n\t{\n\t\ttlsCfg, err := tls.NewServerConfig(log.With(logger, \"protocol\", \"gRPC\"), conf.grpcConfig.tlsSrvCert, conf.grpcConfig.tlsSrvKey, conf.grpcConfig.tlsSrvClientCA, conf.grpcConfig.tlsMinVersion, conf.grpcConfig.tlsCiphers, conf.grpcConfig.tlsCurves)\n\t\tif err != nil {\n\t\t\treturn errors.Wrap(err, \"setup gRPC server\")\n\t\t}\n\n\t\tif conf.lazyRetrievalMaxBufferedResponses <= 0 {\n\t\t\treturn errors.New(\"--receive.lazy-retrieval-max-buffered-responses must be > 0\")\n\t\t}\n\t\toptions := []store.ProxyStoreOption{\n\t\t\tstore.WithProxyStoreDebugLogging(debugLogging),\n\t\t\tstore.WithMatcherCache(cache),\n\t\t\tstore.WithoutDedup(),\n\t\t\tstore.WithLazyRetrievalMaxBufferedResponsesForProxy(conf.lazyRetrievalMaxBufferedResponses),\n\t\t}\n\n\t\tproxy := store.NewProxyStore(\n\t\t\tlogger,\n\t\t\treg,\n\t\t\tdbs.TSDBLocalClients,\n\t\t\tcomp,\n\t\t\tlabels.Labels{},","sourceCodeStart":344,"sourceCodeEnd":380,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/cmd/thanos/receive.go#L344-L380","documentation":"While setting up the gRPC server, runReceive calls tls.NewServerConfig to build the server TLS configuration from the certificate, key, client CA, min version, ciphers and curves flags. Any failure loading or validating these TLS materials is wrapped with 'setup gRPC server', so receive cannot serve gRPC and exits.","triggerScenarios":"Starting `thanos receive` with --grpc-server.tls-cert/--grpc-server.tls-key (and optionally --grpc-server.tls-client-ca) where the cert/key files do not exist, are unreadable, are invalid/expired PEM, do not form a matching pair, or a min-version/cipher/curve name is unknown.","commonSituations":"TLS secret mounted at the wrong path; expired certificates; key without cert or mismatched pair; unsupported TLS version/cipher string on the deployed Go version; missing client CA file when mTLS is required.","solutions":["Check the underlying wrapped error — it names which TLS input failed (cert, key, CA, cipher, etc.).","Verify cert/key/CA file paths passed via --grpc-server.tls-* exist and are readable by the process.","Confirm the certificate and key are a valid matching PEM pair (openssl x509/x509 -modulus check) and not expired.","Use supported values for --grpc-server.tls-min-version, tls-ciphers and tls-curves for your Go version.","If TLS is not needed, omit the TLS flags entirely so tls.NewServerConfig is not asked to load files."],"exampleFix":"// before\nthanos receive --grpc-server.tls-cert=/missing/cert.pem --grpc-server.tls-key=/missing/key.pem\n// after\nthanos receive --grpc-server.tls-cert=/etc/thanos/tls/cert.pem --grpc-server.tls-key=/etc/thanos/tls/key.pem --grpc-server.tls-client-ca=/etc/thanos/tls/ca.pem","handlingStrategy":"validation","validationCode":"for _, p := range []string{tlsCert, tlsKey, tlsClientCA} {\n  if p != \"\" {\n    if _, err := tls.LoadX509KeyPair(p, p); p == tlsClientCA {\n      if _, err := os.ReadFile(p); err != nil { return err }\n    } else if _, err := os.Stat(p); err != nil { return err }\n  }\n}\n// plus: openssl x509 -in cert.pem -checkend 0 and verify key pair match","typeGuard":null,"tryCatchPattern":"if err := run(); err != nil {\n  if strings.Contains(err.Error(), \"setup gRPC server\") {\n    log.Errorf(\"check TLS cert/key/CA paths and validity: %v\", err)\n  }\n}","preventionTips":["Mount TLS secrets at stable, readable paths before start","Rotate certs before expiry and validate pairs with openssl","Use only Go-supported TLS min-version/cipher/curve values","Skip TLS flags when mTLS is not used"],"tags":["tls","grpc","startup","certificates"],"backgroundTag":"tls-certificate-load-failed","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}