{"record":{"id":"704ce70107b7fcb8","repo":"fatedier/frp","slug":"gen-tls-config-error-v","errorCode":null,"errorMessage":"gen TLS config error: %v","messagePattern":"gen TLS config error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/plugin/client/internal/httpsserver/server.go","lineNumber":34,"sourceCode":"\npackage httpsserver\n\nimport (\n\t\"crypto/tls\"\n\t\"fmt\"\n\t\"net/http\"\n\t\"time\"\n\n\t\"github.com/samber/lo\"\n\n\t\"github.com/fatedier/frp/pkg/transport\"\n\thttppkg \"github.com/fatedier/frp/pkg/util/http\"\n)\n\nfunc New(handler http.Handler, crtPath, keyPath string, enableHTTP2 *bool) (*http.Server, error) {\n\ttlsConfig, err := transport.NewServerTLSConfig(crtPath, keyPath, \"\")\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"gen TLS config error: %v\", err)\n\t}\n\n\tserver := &http.Server{\n\t\tHandler:           withMisdirectedRequestCheck(handler),\n\t\tReadHeaderTimeout: 60 * time.Second,\n\t\tTLSConfig:         tlsConfig,\n\t}\n\tif !lo.FromPtr(enableHTTP2) {\n\t\tserver.TLSNextProto = make(map[string]func(*http.Server, *tls.Conn, http.Handler))\n\t}\n\treturn server, nil\n}\n\nfunc withMisdirectedRequestCheck(handler http.Handler) http.Handler {\n\treturn http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n\t\tif r.TLS != nil {\n\t\t\ttlsServerName, _ := httppkg.CanonicalHost(r.TLS.ServerName)\n\t\t\thost, _ := httppkg.CanonicalHost(r.Host)","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/fatedier/frp/blob/6c8a8d0a97d03b44e9528d30b30c70cb9d61b405/pkg/plugin/client/internal/httpsserver/server.go#L16-L52","documentation":"The HTTPS-plugin server failed to build its TLS configuration from the certificate and key paths passed to New(). transport.NewServerTLSConfig loads and pairs crtPath/keyPath; any load or parse failure (missing file, bad PEM, key/cert mismatch) is wrapped into this error when creating the plugin's local https server.","triggerScenarios":"Configuring an https2http/https2https type plugin server (v1.HTTPS2HTTPPluginOptions etc.) where pluginCRTPath/pluginKeyPath point to unreadable, malformed, or mismatched PEM files.","commonSituations":"Cert file path wrong or not mounted into the container; key and certificate swapped in config; expired/re-issued cert with stray text in the PEM; file permissions deny the frp process read access.","solutions":["Check the wrapped %v error: file-not-found means fix the path; tls error 'failed to find any PEM data' means the file is not valid PEM","Verify crtPath holds the certificate and keyPath the private key (not swapped), and that they match (same public key)","Ensure the frp process can read both files (permissions, container volume mounts)","Validate with: openssl x509 -in crt.pem -noout && openssl pkey -in key.pem -noout"],"exampleFix":"// before (frpc.toml)\n[[proxies]]\nname = \"web\"\ntype = \"https\"\n[proxies.plugin]\ntype = \"https2http\"\ncrtPath = \"/etc/wrong/cert.pem\"\nkeyPath = \"/etc/wrong/key.pem\"\n\n// after\ncrtPath = \"/etc/frp/cert.pem\"   # valid PEM certificate\nkeyPath = \"/etc/frp/key.pem\"    # matching PEM private key","handlingStrategy":"validation","validationCode":"// Validate cert/key files before starting frpc\nif _, err := tls.LoadX509KeyPair(crtPath, keyPath); err != nil {\n    return fmt.Errorf(\"bad plugin cert/key: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if _, err := httpsserver.New(h, crt, key, enableHTTP2); err != nil {\n    log.Errorf(\"plugin TLS setup failed (check crtPath/keyPath): %v\", err)\n}","preventionTips":["Run openssl x509/pkey checks on cert files in CI before deploy","Mount cert files read-only into containers at fixed paths referenced by config","Alert on cert expiry so renewals never leave mismatched pairs"],"tags":["tls","plugin","configuration","go"],"backgroundTag":null,"analyzedSha":"6c8a8d0a97d03b44e9528d30b30c70cb9d61b405","analyzedAt":"2026-08-15T06:53:27.215Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}