{"record":{"id":"a3cea9c2195334c4","repo":"sgl-project/sglang","slug":"ssl-key-file-not-found-cfg-ssl-keyfile-pleas","errorCode":null,"errorMessage":"SSL key file not found: '{cfg.ssl_keyfile}'. Please check the --ssl-keyfile path.","messagePattern":"SSL key file not found: '(.+?)'\\. Please check the --ssl-keyfile path\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"python/sglang/srt/server_args.py","lineNumber":4328,"sourceCode":"            raise ValueError(\n                \"--ssl-keyfile requires --ssl-certfile to be specified as well.\"\n            )\n        if cfg.ssl_certfile and not cfg.ssl_keyfile:\n            raise ValueError(\n                \"--ssl-certfile requires --ssl-keyfile to be specified as well.\"\n            )\n        if not cfg.ssl_certfile and not cfg.ssl_keyfile:\n            if cfg.ssl_ca_certs:\n                raise ValueError(\n                    \"--ssl-ca-certs has no effect without --ssl-certfile and --ssl-keyfile.\"\n                )\n            if cfg.ssl_keyfile_password:\n                raise ValueError(\n                    \"--ssl-keyfile-password has no effect without --ssl-certfile and --ssl-keyfile.\"\n                )\n        # Validate files exist early to avoid late failures after model loading.\n        if cfg.ssl_keyfile and not os.path.isfile(cfg.ssl_keyfile):\n            raise ValueError(\n                f\"SSL key file not found: '{cfg.ssl_keyfile}'. \"\n                f\"Please check the --ssl-keyfile path.\"\n            )\n        if cfg.ssl_certfile and not os.path.isfile(cfg.ssl_certfile):\n            raise ValueError(\n                f\"SSL certificate file not found: '{cfg.ssl_certfile}'. \"\n                f\"Please check the --ssl-certfile path.\"\n            )\n        if cfg.ssl_ca_certs and not os.path.isfile(cfg.ssl_ca_certs):\n            raise ValueError(\n                f\"SSL CA certificates file not found: '{cfg.ssl_ca_certs}'. \"\n                f\"Please check the --ssl-ca-certs path.\"\n            )\n        if cfg.enable_ssl_refresh and not (cfg.ssl_certfile and cfg.ssl_keyfile):\n            raise ValueError(\n                \"--enable-ssl-refresh requires --ssl-certfile and --ssl-keyfile \"\n                \"to be specified.\"\n            )","sourceCodeStart":4310,"sourceCodeEnd":4346,"githubUrl":"https://github.com/sgl-project/sglang/blob/0132848349585cfe6aae51c4941cbae872505f8a/python/sglang/srt/server_args.py#L4310-L4346","documentation":"ServerArgs validation error raised when the file given by --ssl-keyfile does not exist on disk. SGLang checks early (before model loading) so a bad TLS path fails in seconds instead of after a multi-minute model load.","triggerScenarios":"Launching with --ssl-keyfile pointing to a nonexistent path: wrong directory, typo, file not mounted into the container, or relative path resolved from a different CWD.","commonSituations":"Docker/Kubernetes deployments where the secret mount path differs from the local one; running from a different working directory with relative paths; cert rotation scripts that moved/renamed files.","solutions":["Fix the path: use an absolute path to the existing key file","If containerized, verify the secret/volume is actually mounted at that path (kubectl exec ls)","If relative, check the process CWD or switch to absolute paths"],"exampleFix":"# before\n--ssl-keyfile server.key  # file lives in /etc/sglang/tls/\n# after\n--ssl-keyfile /etc/sglang/tls/server.key","handlingStrategy":"validation","validationCode":"import os\n\ndef validate_ssl_paths(key: str | None, cert: str | None, ca: str | None) -> None:\n    if key and not os.path.isfile(key):\n        raise FileNotFoundError(key)\n    if cert and not os.path.isfile(cert):\n        raise FileNotFoundError(cert)\n    if ca and not os.path.isfile(ca):\n        raise FileNotFoundError(ca)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use absolute paths for all TLS file flags","In containers, verify secret mounts before launch (entrypoint ls check)","Run os.path.isfile checks in a preflight script or container entrypoint"],"tags":["sglang","ssl","tls","file-not-found","deployment"],"backgroundTag":"ssl-certificate-file-not-found","analyzedSha":"0132848349585cfe6aae51c4941cbae872505f8a","analyzedAt":"2026-08-28T05:10:05.995Z","schemaVersion":2},"datasetVersion":"2026-08-28T06:17:29.519Z"}