{"record":{"id":"8b7194c39d20bf11","repo":"nats-io/nats-server","slug":"tls-cert-and-key-required-for-https","errorCode":null,"errorMessage":"TLS cert and key required for HTTPS","messagePattern":"TLS cert and key required for HTTPS","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/server.go","lineNumber":3036,"sourceCode":"func (s *Server) StartHTTPSMonitoring() {\n\ts.startMonitoring(true)\n}\n\n// StartMonitoring starts the HTTP or HTTPs server if needed.\nfunc (s *Server) StartMonitoring() error {\n\t// Snapshot server options.\n\topts := s.getOpts()\n\n\t// Specifying both HTTP and HTTPS ports is a misconfiguration\n\tif opts.HTTPPort != 0 && opts.HTTPSPort != 0 {\n\t\treturn fmt.Errorf(\"can't specify both HTTP (%v) and HTTPs (%v) ports\", opts.HTTPPort, opts.HTTPSPort)\n\t}\n\tvar err error\n\tif opts.HTTPPort != 0 {\n\t\terr = s.startMonitoring(false)\n\t} else if opts.HTTPSPort != 0 {\n\t\tif opts.TLSConfig == nil {\n\t\t\treturn fmt.Errorf(\"TLS cert and key required for HTTPS\")\n\t\t}\n\t\terr = s.startMonitoring(true)\n\t}\n\treturn err\n}\n\n// HTTP endpoints\nconst (\n\tRootPath         = \"/\"\n\tVarzPath         = \"/varz\"\n\tConnzPath        = \"/connz\"\n\tRoutezPath       = \"/routez\"\n\tGatewayzPath     = \"/gatewayz\"\n\tLeafzPath        = \"/leafz\"\n\tSubszPath        = \"/subsz\"\n\tStackszPath      = \"/stacksz\"\n\tAccountzPath     = \"/accountz\"\n\tAccountStatzPath = \"/accstatz\"","sourceCodeStart":3018,"sourceCodeEnd":3054,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/server.go#L3018-L3054","documentation":"Monitoring was configured on HTTPS (`https_port`) but the options carry no TLS configuration. An HTTPS monitor endpoint requires a certificate and key via tls config; StartMonitoring rejects this misconfiguration at startup.","triggerScenarios":"Config sets `https_port` but no `tls { cert, key }` block, so opts.TLSConfig == nil when StartMonitoring runs.","commonSituations":"Copying an HTTP-port config and renaming the field to https_port without adding TLS; assuming monitoring TLS is configured separately from client TLS; missing cert files commented out.","solutions":["Add a `tls` block with cert/key (and ca if needed) to the server config alongside https_port","Or use plain `http_port` if TLS is not required","Ensure the TLS block is at the right level so it populates opts.TLSConfig"],"exampleFix":"// before\nhttps_port: 8222\n// after\nhttps_port: 8222\ntls {\n  cert: \"./certs/server-cert.pem\"\n  key: \"./certs/server-key.pem\"\n}","handlingStrategy":"validation","validationCode":"// Before Start(): https_port requires a TLS config with cert+key\nif opts.HTTPSPort != 0 {\n    if opts.TLSConfig == nil || len(opts.TLSConfig.Certificates) == 0 {\n        return errors.New(\"https_port set but no TLS cert/key configured\")\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := srv.StartMonitoring(); err != nil {\n    if strings.Contains(err.Error(), \"TLS cert and key required\") {\n        log.Print(\"add a tls{cert,key} block or switch to http_port\")\n    }\n    return err\n}","preventionTips":["Pair every https_port with a tls block containing cert and key","Load and verify cert/key files exist at deploy time (stat them in CI)","Use http_port when TLS termination happens on a reverse proxy"],"tags":["nats-server","monitoring","tls","configuration"],"backgroundTag":"missing-tls-config","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}