{"record":{"id":"79479ca80a6c77b3","repo":"microsoft/garnet","slug":"need-to-provide-sslclientauthenticationoptions-whe","errorCode":null,"errorMessage":"Need to provide SslClientAuthenticationOptions when TLS is enabled","messagePattern":"Need to provide SslClientAuthenticationOptions when TLS is enabled","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"libs/common/Networking/NetworkHandler.cs","lineNumber":216,"sourceCode":"            catch (Exception ex)\n            {\n                logger?.LogWarning(ex, \"An error has occurred\");\n                readerStatus = TlsReaderStatus.Rest;\n                if (expectingData.CurrentCount == 0) expectingData.Release();\n                Dispose();\n                throw;\n            }\n        }\n\n        /// <summary>\n        /// Begin (background) network handler.\n        /// \n        /// Blocks until auth completes.\n        /// </summary>\n        public virtual void Start(SslClientAuthenticationOptions tlsOptions, string remoteEndpointName = null, CancellationToken token = default)\n        {\n            if (tlsOptions != null && sslStream == null)\n                throw new Exception(\"Need to provide SslClientAuthenticationOptions when TLS is enabled\");\n            if (tlsOptions == null && sslStream != null)\n                throw new Exception(\"Cannot provide SslClientAuthenticationOptions when TLS is disabled\");\n            if (tlsOptions == null && sslStream == null) return;\n\n            // Can't use SslStream's sync methods for auth, so we must block\n            AsyncUtils.BlockingWait(AuthenticateAsClientAsync(tlsOptions, remoteEndpointName, token));\n        }\n\n        /// <summary>\n        /// Begin async network handler (including auth).\n        /// \n        /// When tasks completes, authentication has also completed.\n        /// </summary>\n        public virtual async Task StartAsync(SslClientAuthenticationOptions tlsOptions, string remoteEndpointName = null, CancellationToken token = default)\n        {\n            if (tlsOptions != null && sslStream == null)\n                throw new Exception(\"Need to provide SslClientAuthenticationOptions when TLS is enabled\");\n            if (tlsOptions == null && sslStream != null)","sourceCodeStart":198,"sourceCodeEnd":234,"githubUrl":"https://github.com/microsoft/garnet/blob/951b0fc6838721f89d102c2bbe1b914e8d39d700/libs/common/Networking/NetworkHandler.cs#L198-L234","documentation":"Thrown by the client-side NetworkHandler.Start when tlsOptions is non-null but the handler was constructed without TLS (sslStream == null). The client variant: supplying SslClientAuthenticationOptions to a plain-TCP client handler is a configuration contradiction fixed at construction time.","triggerScenarios":"Constructing a client NetworkHandler without an SslStream, then calling Start(SslClientAuthenticationOptions) with non-null options.","commonSituations":"Client TLS enabled in config but the connection built a non-TLS handler; replication/cluster client wiring where the TLS flag and handler construction disagree.","solutions":["Build the client handler with TLS exactly when client auth options will be supplied.","Keep the client TLS decision in one place used by both handler construction and Start.","Validate sslStream presence matches the options argument at the call site."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Ensure client handler TLS mode matches options before Start\nif (tlsOpts != null && !handler.IsTlsEnabled)\n    throw new InvalidOperationException(\"Cannot start a non-TLS client handler with TLS options\");\nhandler.Start(tlsOpts, remoteEndpointName, token);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Construct the client handler with TLS exactly when client auth options will be supplied.","Keep the client TLS decision in one config-sourced location.","Assert sslStream/options pairing at the call site."],"tags":["network","tls","client","config","garnet"],"backgroundTag":null,"analyzedSha":"951b0fc6838721f89d102c2bbe1b914e8d39d700","analyzedAt":"2026-08-13T19:01:32.939Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}