{"record":{"id":"adcc15778acccd62","repo":"prestodb/presto","slug":"flight-shim-server-ssl-enabled-is-enabled-but-f","errorCode":null,"errorMessage":"'flight-shim.server-ssl-enabled' is enabled but 'flight-shim.server-ssl-certificate-file' or 'flight-shim.server-ssl-key-file' not set","messagePattern":"'flight-shim\\.server-ssl-enabled' is enabled but 'flight-shim\\.server-ssl-certificate-file' or 'flight-shim\\.server-ssl-key-file' not set","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"presto-flight-shim/src/main/java/com/facebook/presto/flightshim/FlightShimServer.java","lineNumber":80,"sourceCode":"\n    public static FlightServer start(Injector injector, FlightServer.Builder builder, Map<String, Map<String, String>> additionalCatalogs)\n            throws Exception\n    {\n        FlightShimPluginManager pluginManager = injector.getInstance(FlightShimPluginManager.class);\n        pluginManager.loadPlugins();\n        pluginManager.loadCatalogs(additionalCatalogs);\n\n        builder.allocator(injector.getInstance(BufferAllocator.class));\n        FlightShimConfig config = injector.getInstance(FlightShimConfig.class);\n\n        if (config.getServerName() == null || config.getServerPort() == null) {\n            throw new IllegalArgumentException(\"Required configuration 'flight-shim.server' and 'flight-shim.server.port' not set\");\n        }\n\n        if (config.getServerSslEnabled()) {\n            builder.location(Location.forGrpcTls(config.getServerName(), config.getServerPort()));\n            if (config.getServerSSLCertificateFile() == null || config.getServerSSLKeyFile() == null) {\n                throw new IllegalArgumentException(\"'flight-shim.server-ssl-enabled' is enabled but 'flight-shim.server-ssl-certificate-file' or 'flight-shim.server-ssl-key-file' not set\");\n            }\n            File certChainFile = new File(config.getServerSSLCertificateFile());\n            File privateKeyFile = new File(config.getServerSSLKeyFile());\n            builder.useTls(certChainFile, privateKeyFile);\n\n            // Check if client cert is provided for mTLS\n            if (config.getClientSSLCertificateFile() != null) {\n                File clientCertFile = new File(config.getClientSSLCertificateFile());\n                builder.useMTlsClientVerification(clientCertFile);\n            }\n        }\n        else {\n            builder.location(Location.forGrpcInsecure(config.getServerName(), config.getServerPort()));\n        }\n\n        ExecutorService executor = injector.getInstance(Key.get(ExecutorService.class, ForFlightShimServer.class));\n        builder.executor(new ContextPropagatingExecutorService(executor));\n","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-flight-shim/src/main/java/com/facebook/presto/flightshim/FlightShimServer.java#L62-L98","documentation":"FlightShimServer.start() validates SSL configuration when flight-shim.server-ssl-enabled=true. If either the certificate file or the private key file property is missing, it refuses to start a TLS gRPC server because Arrow Flight's builder.useTls() requires both files to exist.","triggerScenarios":"Calling FlightShimServer.start() (typically from main) with flight-shim.server-ssl-enabled=true while flight-shim.server-ssl-certificate-file or flight-shim.server-ssl-key-file is null/unset in the config.","commonSituations":"Operator enables SSL in the shim's properties file but forgets to add the cert/key paths; deployment templating drops optional properties; migrating from a plaintext setup by only flipping the ssl-enabled flag.","solutions":["Set both flight-shim.server-ssl-certificate-file and flight-shim.server-ssl-key-file in the server config to valid PEM file paths.","If TLS is not needed yet, set flight-shim.server-ssl-enabled=false.","Verify the property names are spelled exactly (ssl-certificate-file vs ssl-cert) so they are actually picked up by the config loader.","Confirm the process can read the cert/key files at those paths."],"exampleFix":"// before\nflight-shim.server-ssl-enabled=true\n// after\nflight-shim.server-ssl-enabled=true\nflight-shim.server-ssl-certificate-file=/etc/presto/tls/cert.pem\nflight-shim.server-ssl-key-file=/etc/presto/tls/key.pem","handlingStrategy":"validation","validationCode":"Properties props = loadProps();\nif (Boolean.parseBoolean(props.getProperty(\"flight-shim.server-ssl-enabled\", \"false\"))) {\n    requireNonNull(props.getProperty(\"flight-shim.server-ssl-certificate-file\"), \"ssl cert file required\");\n    requireNonNull(props.getProperty(\"flight-shim.server-ssl-key-file\"), \"ssl key file required\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set cert and key properties together whenever ssl-enabled is true","Validate the full config before calling FlightShimServer.start()","Template both TLS properties in deployment configs","Test startup with the production config profile in CI"],"tags":["configuration","ssl","arrow-flight"],"backgroundTag":"missing-config-property","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}