{"record":{"id":"b1da277453923300","repo":"stalwartlabs/stalwart","slug":"failed-to-install-aws-lc-rs-as-the-default-rustls","errorCode":null,"errorMessage":"failed to install aws-lc-rs as the default rustls crypto provider","messagePattern":"failed to install aws-lc-rs as the default rustls crypto provider","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"crates/main/src/main.rs","lineNumber":38,"sourceCode":"use trc::Collector;\nuse utils::wait_for_shutdown;\n\n#[cfg(feature = \"dev_mode\")]\npub mod test_data;\n\n#[cfg(not(any(target_env = \"msvc\", target_os = \"freebsd\")))]\nuse tikv_jemallocator::Jemalloc;\n\n#[cfg(not(any(target_env = \"msvc\", target_os = \"freebsd\")))]\n#[global_allocator]\nstatic GLOBAL: Jemalloc = Jemalloc;\n\n#[tokio::main]\nasync fn main() -> std::io::Result<()> {\n    // Install AWS-LC-RS as the default Rustls crypto provider\n    rustls::crypto::aws_lc_rs::default_provider()\n        .install_default()\n        .expect(\"failed to install aws-lc-rs as the default rustls crypto provider\");\n\n    // Build the shared outbound TLS configurations\n    utils::http::init_shared_tls_configs();\n\n    // Load config and apply macros\n    let mut init = Box::pin(BootManager::init()).await;\n\n    // Migrate database\n    if let Err(err) = migration::try_migrate(&init.inner.build_server()).await {\n        trc::event!(\n            Server(trc::ServerEvent::StartupError),\n            Details = \"Failed to migrate database, aborting startup.\",\n            Reason = err,\n        );\n        return Ok(());\n    }\n\n    // Init services","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/stalwartlabs/stalwart/blob/e96200385781a6a9995a8b839ac27d6c75a983ee/crates/main/src/main.rs#L20-L56","documentation":"Rustls requires exactly one process-wide default crypto provider. This panic fires when `aws_lc_rs::default_provider().install_default()` returns Err, which happens only if a default provider was already installed (or another provider was installed first, e.g. by a dependency using ring). The process cannot start because TLS cannot be configured as intended.","triggerScenarios":"Calling main after some other code path (a dependency, an earlier init, or duplicate installation) has already installed a rustls CryptoProvider via `install_default()`, or having two provider installations in the binary.","commonSituations":"A dependency (e.g. a library that installs the ring provider) is pulled in and initializes before main; the binary is built with both ring and aws-lc-rs features and some crate initializes ring first; duplicate install calls in embedded/test setups.","solutions":["Ensure no dependency installs a rustls provider before main runs; check Cargo features for duplicate crypto provider crates (ring + aws-lc-rs)","If a provider may already be installed, replace install_default().expect() with try_install() or check the Result instead of panicking","Explicitly pass the provider to ClientConfig/ServerConfig builders instead of relying on the process default","Update dependencies so only one TLS crypto provider is active"],"exampleFix":"// before\nrustls::crypto::aws_lc_rs::default_provider()\n    .install_default()\n    .expect(\"failed to install aws-lc-rs as the default rustls crypto provider\");\n// after\nlet _ = rustls::crypto::aws_lc_rs::default_provider().install_default();","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"// install_default returns Result; don't panic if a provider exists:\nif rustls::crypto::CryptoProvider::get_default().is_none() {\n    rustls::crypto::aws_lc_rs::default_provider()\n        .install_default()\n        .expect(\"failed to install default crypto provider\");\n}","preventionTips":["Audit Cargo features for multiple rustls crypto provider crates","Do not install a crypto provider in library code; leave it to the binary's main","Prefer passing providers explicitly to config builders over process-global defaults"],"tags":["rustls","tls","crypto","startup"],"backgroundTag":"module-init-failed","analyzedSha":"e96200385781a6a9995a8b839ac27d6c75a983ee","analyzedAt":"2026-09-06T22:07:17.982Z","contentChangedAt":"2026-09-06T22:07:17.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}