{"record":{"id":"736849d45d259019","repo":"yudai/gotty","slug":"failed-to-setup-tls-configuration","errorCode":null,"errorMessage":"failed to setup TLS configuration","messagePattern":"failed to setup TLS configuration","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/server.go","lineNumber":223,"sourceCode":"\tsiteHandler = server.wrapLogger(withGz)\n\n\twsMux := http.NewServeMux()\n\twsMux.Handle(\"/\", siteHandler)\n\twsMux.HandleFunc(pathPrefix+\"ws\", server.generateHandleWS(ctx, cancel, counter))\n\tsiteHandler = http.Handler(wsMux)\n\n\treturn siteHandler\n}\n\nfunc (server *Server) setupHTTPServer(handler http.Handler) (*http.Server, error) {\n\tsrv := &http.Server{\n\t\tHandler: handler,\n\t}\n\n\tif server.options.EnableTLSClientAuth {\n\t\ttlsConfig, err := server.tlsConfig()\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrapf(err, \"failed to setup TLS configuration\")\n\t\t}\n\t\tsrv.TLSConfig = tlsConfig\n\t}\n\n\treturn srv, nil\n}\n\nfunc (server *Server) tlsConfig() (*tls.Config, error) {\n\tcaFile := homedir.Expand(server.options.TLSCACrtFile)\n\tcaCert, err := ioutil.ReadFile(caFile)\n\tif err != nil {\n\t\treturn nil, errors.New(\"could not open CA crt file \" + caFile)\n\t}\n\tcaCertPool := x509.NewCertPool()\n\tif !caCertPool.AppendCertsFromPEM(caCert) {\n\t\treturn nil, errors.New(\"could not parse CA crt file data in \" + caFile)\n\t}\n\ttlsConfig := &tls.Config{","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/yudai/gotty/blob/a080c85cbc59226c94c6941ad8c395232d72d517/server/server.go#L205-L241","documentation":"setupHTTPServer() constructs the http.Server; when EnableTLSClientAuth is enabled it also builds a tls.Config via server.tlsConfig(). Any failure there is wrapped with this message and propagates to Run() (which wraps it again as 'failed to setup an HTTP server').","triggerScenarios":"Calling Run() with EnableTLSClientAuth=true while tlsConfig() fails — CA cert file unreadable (error 14) or unparseable (error 15).","commonSituations":"Mutual-TLS setups where tls_ca_crt_file is unset (expands to a bad default path) or points to a leaf cert/invalid PEM instead of a CA.","solutions":["Inspect the wrapped inner error for the exact cause","Ensure tls_ca_crt_file points to an existing PEM-encoded CA certificate","Disable enable_tls_client_auth if mTLS is not required"],"exampleFix":"// before\ntls_ca_crt_file = \"\"\nenable_tls_client_auth = true\n// after\ntls_ca_crt_file = \"/etc/gotty/ca.crt\"\nenable_tls_client_auth = true","handlingStrategy":"validation","validationCode":"if opts.EnableTLSClientAuth && opts.TLSCACrtFile == \"\" {\n    log.Fatal(\"enable_tls_client_auth requires tls_ca_crt_file\")\n}","typeGuard":null,"tryCatchPattern":"if err := srv.Run(ctx); err != nil {\n    if strings.Contains(err.Error(), \"failed to setup TLS configuration\") {\n        log.Fatalf(\"TLS setup: %v\", err)\n    }\n}","preventionTips":["Always pair enable_tls_client_auth with a valid tls_ca_crt_file","Smoke-test TLS options with a minimal startup before deploying"],"tags":["tls","mtls","configuration"],"backgroundTag":"tls-config-setup-failed","analyzedSha":"a080c85cbc59226c94c6941ad8c395232d72d517","analyzedAt":"2026-09-02T16:42:38.150Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T21:17:11.164Z"}