{"record":{"id":"9f8d62f3f03a6d4d","repo":"phacility/phabricator","slug":"a-specified-server-at-index-s-on-port-s-s","errorCode":null,"errorMessage":"A specified server (at index \"%s\", on port \"%s\") specifies only one of \"%s\" and \"%s\". Each server must specify neither (to disable SSL) or specify both (to enable it).","messagePattern":"A specified server \\(at index \"(.+?)\", on port \"(.+?)\"\\) specifies only one of \"(.+?)\" and \"(.+?)\"\\. Each server must specify neither \\(to disable SSL\\) or specify both \\(to enable it\\)\\.","errorType":"console","errorClass":"PhutilArgumentUsageException","httpStatus":null,"severity":"error","filePath":"src/applications/aphlict/management/PhabricatorAphlictManagementWorkflow.php","lineNumber":141,"sourceCode":"          $has_admin = true;\n          break;\n        case 'client':\n          $has_client = true;\n          break;\n        default:\n          throw new PhutilArgumentUsageException(\n            pht(\n              'A specified server (at index \"%s\", on port \"%s\") has an '.\n              'invalid type (\"%s\"). Valid types are: admin, client.',\n              $index,\n              $port,\n              $type));\n      }\n\n      $ssl_key = idx($server, 'ssl.key');\n      $ssl_cert = idx($server, 'ssl.cert');\n      if (($ssl_key && !$ssl_cert) || ($ssl_cert && !$ssl_key)) {\n        throw new PhutilArgumentUsageException(\n          pht(\n            'A specified server (at index \"%s\", on port \"%s\") specifies '.\n            'only one of \"%s\" and \"%s\". Each server must specify neither '.\n            '(to disable SSL) or specify both (to enable it).',\n            $index,\n            $port,\n            'ssl.key',\n            'ssl.cert'));\n      }\n\n      $ssl_chain = idx($server, 'ssl.chain');\n      if ($ssl_chain && (!$ssl_key && !$ssl_cert)) {\n        throw new PhutilArgumentUsageException(\n          pht(\n            'A specified server (at index \"%s\", on port \"%s\") specifies '.\n            'a value for \"%s\", but no value for \"%s\" or \"%s\". Servers '.\n            'should only provide an SSL chain if they also provide an SSL '.\n            'key and SSL certificate.',","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/aphlict/management/PhabricatorAphlictManagementWorkflow.php#L123-L159","documentation":"Thrown when an Aphlict server entry specifies exactly one of the SSL options 'ssl.key' and 'ssl.cert'. SSL for a listener requires both a private key and a certificate; specifying only one is treated as a configuration error rather than silently starting plaintext.","triggerScenarios":"A server entry has \"ssl.key\": \"/path/key.pem\" but no \"ssl.cert\" (or vice versa), including the case where one is set to an empty-but-truthy string.","commonSituations":"Admin enables TLS incrementally and forgets the second file; paths use null for one and a path for the other after templating; cert renewal script rewrites only ssl.cert.","solutions":["Provide both \"ssl.key\" and \"ssl.cert\" on the server entry to enable SSL, or remove/null both to disable it","Verify both paths exist and are readable by the user that runs aphlict before restarting","If you only meant to terminate TLS at a proxy/load balancer, remove ssl.* keys entirely and keep plain listeners"],"exampleFix":"// before\n{\"type\": \"client\", \"port\": 22280, \"ssl.key\": \"/etc/ssl/aphlict.key\"}\n// after\n{\"type\": \"client\", \"port\": 22280,\n \"ssl.key\": \"/etc/ssl/aphlict.key\",\n \"ssl.cert\": \"/etc/ssl/aphlict.crt\"}","handlingStrategy":"validation","validationCode":"$key = idx($server, 'ssl.key');\n$cert = idx($server, 'ssl.cert');\nif (($key && !$cert) || ($cert && !$key)) {\n  throw new InvalidArgumentException('ssl.key and ssl.cert must be set together');\n}","typeGuard":"function has_paired_ssl_config(array $server) {\n  $k = idx($server, 'ssl.key');\n  $c = idx($server, 'ssl.cert');\n  return ($k && $c) || (!$k && !$c);\n}","tryCatchPattern":null,"preventionTips":["Manage ssl.key/ssl.cert as a pair in templates so one is never emitted alone","Automate cert renewal to rewrite both files together, then restart aphlict"],"tags":["aphlict","ssl","configuration","phabricator"],"backgroundTag":"ssl-certificate-config","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}