{"record":{"id":"799dcc0796b5a8b6","repo":"ipfs/kubo","slug":"private-networking-swarm-key-libp2p-force-pnet","errorCode":null,"errorMessage":"private networking (swarm.key / LIBP2P_FORCE_PNET) does not work with AutoTLS.Enabled=true, update config to remove this message","messagePattern":"private networking \\(swarm\\.key / LIBP2P_FORCE_PNET\\) does not work with AutoTLS\\.Enabled=true, update config to remove this message","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/ipfs/kubo/daemon.go","lineNumber":479,"sourceCode":"\t\t}\n\t}\n\n\tif isPrivateNetwork {\n\t\t// Private setups can't leverage peers returned by default IPNIs (Routing.Type=auto)\n\t\t// To avoid breaking existing setups, switch them to DHT-only.\n\t\tif routingOption == routingOptionAutoKwd {\n\t\t\tlog.Error(\"Private networking (swarm.key / LIBP2P_FORCE_PNET) does not work with public HTTP IPNIs enabled by Routing.Type=auto. Kubo will use Routing.Type=dht instead. Update config to remove this message.\")\n\t\t\troutingOption = routingOptionDHTKwd\n\t\t}\n\n\t\t// Private setups should not use public AutoTLS infrastructure\n\t\t// as it will leak their existence and PeerID identity to CA\n\t\t// and they will show up at https://crt.sh/?q=libp2p.direct\n\t\tenableAutoTLS := cfg.AutoTLS.Enabled.WithDefault(config.DefaultAutoTLSEnabled)\n\t\tif enableAutoTLS {\n\t\t\tif cfg.AutoTLS.Enabled != config.Default {\n\t\t\t\t// hard fail if someone tries to explicitly enable both\n\t\t\t\treturn errors.New(\"private networking (swarm.key / LIBP2P_FORCE_PNET) does not work with AutoTLS.Enabled=true, update config to remove this message\")\n\t\t\t} else {\n\t\t\t\t// print error and disable autotls if user runs on default settings\n\t\t\t\tlog.Error(\"private networking (swarm.key / LIBP2P_FORCE_PNET) is not compatible with AutoTLS. Set AutoTLS.Enabled=false in config to remove this message.\")\n\t\t\t\tcfg.AutoTLS.Enabled = config.False\n\t\t\t}\n\t\t}\n\t}\n\n\t// Use config for routing construction\n\n\tswitch routingOption {\n\tcase routingOptionSupernodeKwd:\n\t\treturn errors.New(\"supernode routing was never fully implemented and has been removed\")\n\tcase routingOptionDefaultKwd, routingOptionAutoKwd:\n\t\tncfg.Routing = libp2p.ConstructDefaultRouting(cfg, libp2p.DHTOption)\n\tcase routingOptionAutoClientKwd:\n\t\tncfg.Routing = libp2p.ConstructDefaultRouting(cfg, libp2p.DHTClientOption)\n\tcase routingOptionDHTClientKwd:","sourceCodeStart":461,"sourceCodeEnd":497,"githubUrl":"https://github.com/ipfs/kubo/blob/329838acdfafae224582930457efe80aa217afc0/cmd/ipfs/kubo/daemon.go#L461-L497","documentation":"Kubo's daemon refuses to start (or disables AutoTLS with a logged error) when private networking via swarm.key or LIBP2P_FORCE_PNET is combined with AutoTLS. AutoTLS obtains certificates from a public CA (libp2p.direct), which would leak the private network's peer identity via crt.sh, so the combination is forbidden.","triggerScenarios":"Running `ipfs daemon` when: (1) AutoTLS.Enabled=true is explicitly set in config while a swarm.key exists or LIBP2P_FORCE_PNET is set -> hard error; (2) AutoTLS is left at default while private networking is active -> logged error, AutoTLS forced off, daemon continues.","commonSituations":"Clusters using private networks (swarm.key) that upgraded and inherited an explicit AutoTLS.Enabled=true from config tooling; CI setups with LIBP2P_FORCE_PNET=1 and copied configs enabling AutoTLS.","solutions":["Set AutoTLS.Enabled=false in the kubo config, or remove the explicit AutoTLS.Enabled entry so it stays at Default","Remove the swarm.key / unset LIBP2P_FORCE_PNET if private networking is not actually required","Restart the daemon; the hard error only fires when AutoTLS.Enabled is explicitly true"],"exampleFix":"// before (config.json)\n\"AutoTLS\": { \"Enabled\": true }\n// after\n\"AutoTLS\": { \"Enabled\": false }","handlingStrategy":"validation","validationCode":"// before starting the daemon\ncfg, _ := ipfsConfigShow()\nif cfg.AutoTLS.Enabled == true && (fileExists(cfg.Swarm.Key) || os.Getenv(\"LIBP2P_FORCE_PNET\") != \"\") {\n    // fix: set AutoTLS.Enabled=false or remove pnet\n    fmt.Println(\"private networking is incompatible with AutoTLS; disable AutoTLS.Enabled\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Do not set AutoTLS.Enabled explicitly unless you use the public network","In pnet deployments, template configs with AutoTLS.Enabled=false","Never combine LIBP2P_FORCE_PNET with public-facing TLS tooling"],"tags":["ipfs","kubo","autotls","private-network","swarm-key","config"],"backgroundTag":"autotls-private-network-conflict","analyzedSha":"329838acdfafae224582930457efe80aa217afc0","analyzedAt":"2026-09-03T18:30:52.135Z","contentChangedAt":"2026-09-03T18:30:52.135Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}