{"record":{"id":"aac099be9b0c1120","repo":"risingwavelabs/risingwave","slug":"rw-ssl-enforce-requires-rw-ssl-cert-and-rw-ssl-key","errorCode":null,"errorMessage":"RW_SSL_ENFORCE requires RW_SSL_CERT and RW_SSL_KEY to be set","messagePattern":"RW_SSL_ENFORCE requires RW_SSL_CERT and RW_SSL_KEY to be set","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/utils/pgwire/src/pg_protocol.rs","lineNumber":139,"sourceCode":"    pub key: String,\n    /// Whether to enforce SSL connections (reject non-SSL clients).\n    pub enforce_ssl: bool,\n}\n\nimpl TlsConfig {\n    pub fn new_default() -> anyhow::Result<Option<Self>> {\n        let cert = std::env::var(\"RW_SSL_CERT\").ok();\n        let key = std::env::var(\"RW_SSL_KEY\").ok();\n        let enforce_ssl = env_var_is_true(\"RW_SSL_ENFORCE\");\n\n        if cert.is_some() ^ key.is_some() {\n            return Err(anyhow::anyhow!(\n                \"RW_SSL_CERT and RW_SSL_KEY must be set together\"\n            ));\n        }\n\n        if enforce_ssl && cert.is_none() {\n            return Err(anyhow::anyhow!(\n                \"RW_SSL_ENFORCE requires RW_SSL_CERT and RW_SSL_KEY to be set\"\n            ));\n        }\n\n        let (Some(cert), Some(key)) = (cert, key) else {\n            return Ok(None);\n        };\n\n        tracing::info!(\n            \"RW_SSL_CERT={}, RW_SSL_KEY={}, RW_SSL_ENFORCE={}\",\n            cert,\n            key,\n            enforce_ssl\n        );\n        Ok(Some(Self {\n            cert,\n            key,\n            enforce_ssl,","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/utils/pgwire/src/pg_protocol.rs#L121-L157","documentation":"When `RW_SSL_ENFORCE=true`, `SslConfig::new_default` requires an actual certificate/key pair; enforcing SSL without `RW_SSL_CERT`/`RW_SSL_KEY` would make TLS impossible, so it aborts startup with this anyhow error.","triggerScenarios":"Starting a node with `RW_SSL_ENFORCE=true` (or '1'/'on') but without both `RW_SSL_CERT` and `RW_SSL_KEY` set.","commonSituations":"Security-hardened deployments flipping the enforce flag without provisioning certificates; environments where certs are injected later than the enforce flag.","solutions":["Set both `RW_SSL_CERT` and `RW_SSL_KEY` to valid PEM file paths.","Disable `RW_SSL_ENFORCE` if TLS is not required in this environment.","Provision a certificate (e.g. via cert-manager) before enabling enforcement."],"exampleFix":"// before\nRW_SSL_ENFORCE=true ./risingwave frontend\n// after\nRW_SSL_ENFORCE=true RW_SSL_CERT=/certs/server.crt RW_SSL_KEY=/certs/server.key ./risingwave frontend","handlingStrategy":"validation","validationCode":"let enforce = std::env::var(\"RW_SSL_ENFORCE\").map(|v| v==\"true\"||v==\"1\").unwrap_or(false);\nif enforce && (std::env::var(\"RW_SSL_CERT\").is_err() || std::env::var(\"RW_SSL_KEY\").is_err()) {\n    panic!(\"RW_SSL_ENFORCE requires RW_SSL_CERT and RW_SSL_KEY\");\n}","typeGuard":null,"tryCatchPattern":"match SslConfig::new_default() {\n    Err(e) if e.to_string().contains(\"RW_SSL_ENFORCE requires\") => provision_certs_and_restart(),\n    other => other?,\n}","preventionTips":["Provision certificates before enabling RW_SSL_ENFORCE.","Document the dependency between enforce and cert/key flags in deployment docs.","Health-check env completeness before starting nodes."],"tags":["rust","tls","configuration","env"],"backgroundTag":"conflicting-config-options","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}