{"record":{"id":"a44258bc4b708d3c","repo":"kopia/kopia","slug":"tls-cert-file-already-exists-q","errorCode":null,"errorMessage":"TLS cert file already exists: %q","messagePattern":"TLS cert file already exists: %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/command_server_tls.go","lineNumber":90,"sourceCode":"\t\tl.Close() //nolint:errcheck\n\n\t\treturn errors.Wrap(err, \"insecure server bind validation\")\n\t}\n\n\tdefer l.Close() //nolint:errcheck\n\n\thttpServer.Addr = l.Addr().String()\n\n\treturn c.startServerWithOptionalTLSAndListener(ctx, httpServer, l)\n}\n\nfunc (c *commandServerStart) maybeGenerateTLS(ctx context.Context) error {\n\tif !c.serverStartTLSGenerateCert || c.serverStartTLSCertFile == \"\" || c.serverStartTLSKeyFile == \"\" {\n\t\treturn nil\n\t}\n\n\tif _, err := os.Stat(c.serverStartTLSCertFile); err == nil {\n\t\treturn errors.Errorf(\"TLS cert file already exists: %q\", c.serverStartTLSCertFile)\n\t}\n\n\tif _, err := os.Stat(c.serverStartTLSKeyFile); err == nil {\n\t\treturn errors.Errorf(\"TLS key file already exists: %q\", c.serverStartTLSKeyFile)\n\t}\n\n\tcert, key, err := c.generateServerCertificate(ctx)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"unable to generate server cert\")\n\t}\n\n\tfingerprint := sha256.Sum256(cert.Raw)\n\tfmt.Fprintf(c.out.stderr(), \"SERVER CERT SHA256: %v\\n\", hex.EncodeToString(fingerprint[:])) //nolint:errcheck\n\n\tlog(ctx).Infof(\"writing TLS certificate to %v\", c.serverStartTLSCertFile)\n\n\tif err := tlsutil.WriteCertificateToFile(c.serverStartTLSCertFile, cert); err != nil {\n\t\treturn errors.Wrap(err, \"unable to write private key\")","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/kopia/kopia/blob/82495e54b584c1ef6073c9e1be048f57f8aef078/cli/command_server_tls.go#L72-L108","documentation":"maybeGenerateTLS refuses to auto-generate a TLS certificate when the target cert file already exists, because generation would overwrite it. The check uses os.Stat success as evidence of existence. This protects an existing certificate from being silently replaced.","triggerScenarios":"Running `kopia server start --tls-generate-cert --tls-cert-file <path> --tls-key-file <path>` when <path> already exists on disk from a previous run.","commonSituations":"Re-running server start with the same cert path after an earlier generation; leftover files in a data directory; a config that pins a long-lived cert file while also requesting generation.","solutions":["Remove/rename the existing cert file if regeneration is intended","Drop --tls-generate-cert and let the server use the existing cert/key files","Point --tls-cert-file/--tls-key-file at new paths"],"exampleFix":"// before\nkopia server start --tls-generate-cert --tls-cert-file cert.pem --tls-key-file key.pem  # cert.pem exists\n// after\nrm cert.pem key.pem && kopia server start --tls-generate-cert --tls-cert-file cert.pem --tls-key-file key.pem","handlingStrategy":"validation","validationCode":"if _, err := os.Stat(certFile); err == nil {\n    return fmt.Errorf(\"refusing to generate: %s exists\", certFile)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use unique cert paths per generation run","Clean up cert+key pairs together","Don't pass --tls-generate-cert when static files are already configured"],"tags":["tls","file-conflict","cli"],"backgroundTag":"file-already-exists","analyzedSha":"82495e54b584c1ef6073c9e1be048f57f8aef078","analyzedAt":"2026-09-07T20:35:21.689Z","contentChangedAt":"2026-09-07T20:35:21.689Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}