{"record":{"id":"ab661deda4f70952","repo":"hyperledger/fabric","slug":"serverconfig-secopts-must-contain-both-key-and-cer","errorCode":null,"errorMessage":"serverConfig.SecOpts must contain both Key and Certificate when UseTLS is true","messagePattern":"serverConfig\\.SecOpts must contain both Key and Certificate when UseTLS is true","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/pkg/comm/server.go","lineNumber":123,"sourceCode":"\t\t\t\t// require TLS client auth\n\t\t\t\tgrpcServer.tls.config.ClientAuth = tls.RequireAndVerifyClientCert\n\t\t\t\t// if we have client root CAs, create a certPool\n\t\t\t\tif len(secureConfig.ClientRootCAs) > 0 {\n\t\t\t\t\tgrpcServer.tls.config.ClientCAs = x509.NewCertPool()\n\t\t\t\t\tfor _, clientRootCA := range secureConfig.ClientRootCAs {\n\t\t\t\t\t\terr = grpcServer.appendClientRootCA(clientRootCA)\n\t\t\t\t\t\tif err != nil {\n\t\t\t\t\t\t\treturn nil, err\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// create credentials and add to server options\n\t\t\tcreds := NewServerTransportCredentials(grpcServer.tls, serverConfig.Logger)\n\t\t\tserverOpts = append(serverOpts, grpc.Creds(creds))\n\t\t} else {\n\t\t\treturn nil, errors.New(\"serverConfig.SecOpts must contain both Key and Certificate when UseTLS is true\")\n\t\t}\n\t}\n\n\t// set max send and recv msg sizes\n\tmaxSendMsgSize := DefaultMaxSendMsgSize\n\tif serverConfig.MaxSendMsgSize != 0 {\n\t\tmaxSendMsgSize = serverConfig.MaxSendMsgSize\n\t}\n\tmaxRecvMsgSize := DefaultMaxRecvMsgSize\n\tif serverConfig.MaxRecvMsgSize != 0 {\n\t\tmaxRecvMsgSize = serverConfig.MaxRecvMsgSize\n\t}\n\tserverOpts = append(serverOpts, grpc.MaxSendMsgSize(maxSendMsgSize))\n\tserverOpts = append(serverOpts, grpc.MaxRecvMsgSize(maxRecvMsgSize))\n\t// set the keepalive options\n\tserverOpts = append(serverOpts, serverConfig.KaOpts.ServerKeepaliveOptions()...)\n\t// set connection timeout\n\tif serverConfig.ConnectionTimeout <= 0 {","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/internal/pkg/comm/server.go#L105-L141","documentation":"Returned by NewGRPCServerFromListener when UseTLS is true but the SecureOptions carry only one of Key/Certificate. A TLS server needs the full keypair; the half-configured security options are rejected during server construction.","triggerScenarios":"Thrown at internal/pkg/comm/server.go:123 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set both peer.tls.certFile and peer.tls.keyFile in SecOpts","Or disable TLS if not needed"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}