{"record":{"id":"714ee09c339d3a88","repo":"vllm-project/vllm","slug":"ssl-cert-reqs-must-be-0-none-1-optional-or","errorCode":null,"errorMessage":"--ssl-cert-reqs must be 0 (none), 1 (optional), or 2 (required), got {}","messagePattern":"--ssl-cert-reqs must be 0 \\(none\\), 1 \\(optional\\), or 2 \\(required\\), got (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"rust/src/server/src/config.rs","lineNumber":142,"sourceCode":"    pub cert_reqs: i32,\n    /// OpenSSL cipher string for TLS 1.2 and below, mirroring Python's\n    /// `ssl.set_ciphers`. `None` keeps the forward-secret AEAD default.\n    pub ciphers: Option<String>,\n}\n\nimpl TlsConfig {\n    /// Structurally validate the TLS arguments; the cert/key material is parsed\n    /// later, when the OpenSSL context is built.\n    pub fn validate(&self) -> Result<()> {\n        if self.cert_file.is_none() {\n            bail!(\n                \"--ssl-certfile is required to enable TLS; \\\n                 --ssl-keyfile/--ssl-ca-certs/--ssl-cert-reqs/--ssl-ciphers \\\n                 cannot be used without it\"\n            );\n        }\n        if !matches!(self.cert_reqs, 0..=2) {\n            bail!(\n                \"--ssl-cert-reqs must be 0 (none), 1 (optional), or 2 (required), got {}\",\n                self.cert_reqs\n            );\n        }\n        if self.cert_reqs != 0 && self.ca_certs.is_none() {\n            bail!(\n                \"--ssl-ca-certs is required when --ssl-cert-reqs is {} \\\n                 (client certificate verification)\",\n                self.cert_reqs\n            );\n        }\n        Ok(())\n    }\n}\n\n/// Normalized runtime configuration for the minimal OpenAI-compatible server.\n#[derive(Educe, Clone, PartialEq, Eq, Serialize)]\n#[educe(Debug)]","sourceCodeStart":124,"sourceCodeEnd":160,"githubUrl":"https://github.com/vllm-project/vllm/blob/c794754062d49a8fdb63ab3c5215b488b865030c/rust/src/server/src/config.rs#L124-L160","documentation":"Thrown by TlsConfig::validate() when --ssl-cert-reqs is outside the accepted set {0, 1, 2}, mirroring Python ssl.CERT_NONE/CERT_OPTIONAL/CERT_REQUIRED. The check is a matches!(self.cert_reqs, 0..=2) guard at startup; the offending numeric value is printed in the message.","triggerScenarios":"Passing --ssl-cert-reqs 3, a negative value, or a non-numeric value that a wrapper coerced to something out of range. Note that even cert_reqs=0 still requires --ssl-certfile to be set (that check runs first), so this error specifically means a cert file was provided but the requirement level is invalid.","commonSituations":"Copying Python code that uses ssl.CERT_REQUIRED (numeric 2) but mis-transcribing it (e.g. 4 after editing); using an enum-like constant from another library whose values do not match 0/1/2; configuration management templating the wrong default.","solutions":["Use 0 for no client cert verification, 1 for optional, 2 for required.","Cross-check against Python: 0=ssl.CERT_NONE, 1=ssl.CERT_OPTIONAL, 2=ssl.CERT_REQUIRED.","If you set --ssl-cert-reqs to 1 or 2, also set --ssl-ca-certs to avoid the follow-on validation error."],"exampleFix":"# before\n--ssl-certfile server.pem --ssl-cert-reqs 4\n\n# after\n--ssl-certfile server.pem --ssl-cert-reqs 2 --ssl-ca-certs ca.pem","handlingStrategy":"validation","validationCode":"fn valid_cert_reqs(v: i32) -> bool {\n    (0..=2).contains(&v)\n}","typeGuard":"fn is_valid_cert_reqs(cert_reqs: i32) -> bool {\n    matches!(cert_reqs, 0..=2)\n}","tryCatchPattern":null,"preventionTips":["Map Python constants once: CERT_NONE=0, CERT_OPTIONAL=1, CERT_REQUIRED=2.","Reject out-of-range values at config parse time in your launcher.","Remember cert_reqs>0 additionally requires --ssl-ca-certs."],"tags":["configuration","tls","ssl","security","rust","vllm","startup"],"backgroundTag":null,"analyzedSha":"c794754062d49a8fdb63ab3c5215b488b865030c","analyzedAt":"2026-08-14T21:17:39.825Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}