{"record":{"id":"906ae7e84ffecb79","repo":"thanos-io/thanos","slug":"when-a-client-ca-is-used-a-server-key-and-certific","errorCode":null,"errorMessage":"when a client CA is used a server key and certificate must also be provided","messagePattern":"when a client CA is used a server key and certificate must also be provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/tls/options.go","lineNumber":29,"sourceCode":"\t\"path/filepath\"\n\t\"sort\"\n\t\"strings\"\n\t\"sync\"\n\t\"time\"\n\n\t\"github.com/go-kit/log\"\n\t\"github.com/go-kit/log/level\"\n\t\"github.com/pkg/errors\"\n)\n\n// AllowedTLSVersions is for global lists the TLS versions allowed to be used.\nvar AllowedTLSVersions = []string{\"1.0\", \"1.1\", \"1.2\", \"1.3\"}\n\n// NewServerConfig provides new server TLS configuration.\nfunc NewServerConfig(logger log.Logger, certPath, keyPath, clientCA, tlsMinVersion string, ciphers []string, curves []string) (*tls.Config, error) {\n\tif keyPath == \"\" && certPath == \"\" {\n\t\tif clientCA != \"\" {\n\t\t\treturn nil, errors.New(\"when a client CA is used a server key and certificate must also be provided\")\n\t\t}\n\n\t\tlevel.Info(logger).Log(\"msg\", \"disabled TLS, key and cert must be set to enable\")\n\t\treturn nil, nil\n\t}\n\n\tlevel.Info(logger).Log(\"msg\", \"enabling server side TLS\")\n\n\tif keyPath == \"\" || certPath == \"\" {\n\t\treturn nil, errors.New(\"both server key and certificate must be provided\")\n\t}\n\n\tminTlsVersion, err := GetTlsVersion(tlsMinVersion)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\ttlsCfg := &tls.Config{","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/pkg/tls/options.go#L11-L47","documentation":"NewServerConfig in pkg/tls rejects the combination of a client CA being provided without any server key/certificate. Serving TLS with client certificate authentication (mTLS) requires the server itself to present a keypair; enabling only the CA is an invalid configuration.","triggerScenarios":"A run* command (runQuery, runReceive, runRule, runSidecar, runStore) is started with --client-ca set but --cert and --key both empty.","commonSituations":"Operators setting only --client-ca intending to enable mTLS but forgetting the server cert/key flags; partially templated Helm/manifest configs where cert paths were dropped.","solutions":["Provide --cert and --key alongside --client-ca to enable full mTLS","If TLS is not wanted, remove the --client-ca flag instead","Validate TLS flags in deployment tooling before rollout","Check generated configs/templates include all three TLS paths"],"exampleFix":"// before\n--client-ca=ca.crt\n// after\n--client-ca=ca.crt --cert=server.crt --key=server.key","handlingStrategy":"validation","validationCode":"// Startup validation wrapper\nif clientCA != \"\" && (certPath == \"\" || keyPath == \"\") {\n    return errors.New(\"mTLS requires --client-ca, --cert and --key all set\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Define one TLS flag bundle (ca+cert+key) in templates so they are set together","Smoke-test server startup with TLS flags in CI","Document that --client-ca alone never enables mTLS"],"tags":["tls","mtls","configuration","server"],"backgroundTag":"missing-required-config-field","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}