{"record":{"id":"b552bbd926bdf3b4","repo":"apache/shenyu","slug":"the-sslcrtandkeys-can-not-be-null","errorCode":null,"errorMessage":"The sslCrtAndKeys can not be null","messagePattern":"The sslCrtAndKeys can not be null","errorType":"exception","errorClass":"ShenyuException","httpStatus":null,"severity":"error","filePath":"shenyu-common/src/main/java/org/apache/shenyu/common/config/ssl/ShenyuSniAsyncMapping.java","lineNumber":48,"sourceCode":"import java.util.List;\nimport java.util.Objects;\nimport java.util.concurrent.ConcurrentHashMap;\nimport java.util.regex.Pattern;\n\n/**\n * Sni async map, can be used to dynamically configure ssl certificates.\n */\npublic class ShenyuSniAsyncMapping implements AsyncMapping<String, SslProvider> {\n\n    private final ConcurrentHashMap<String, SslProvider> sslProviderMap;\n\n    public ShenyuSniAsyncMapping() {\n        this.sslProviderMap = new ConcurrentHashMap<>();\n    }\n\n    public ShenyuSniAsyncMapping(final List<SslCrtAndKeyFile> sslCrtAndKeys) {\n        if (Objects.isNull(sslCrtAndKeys) || sslCrtAndKeys.isEmpty()) {\n            throw new ShenyuException(\"The sslCrtAndKeys can not be null\");\n        }\n        this.sslProviderMap = new ConcurrentHashMap<>();\n        sslCrtAndKeys.forEach(sslCrtAndKey -> {\n            Http11SslContextSpec sslContextSpec = Http11SslContextSpec.forServer(new File(sslCrtAndKey.getKeyCertChainFile()),\n                    new File(sslCrtAndKey.getKeyFile()));\n            SslProvider sslProvider = SslProvider.builder().sslContext(sslContextSpec).build();\n            this.sslProviderMap.put(sslCrtAndKey.getDomain(), sslProvider);\n        });\n    }\n\n    /**\n     * Add SslProvider by domain.\n     *\n     * @param domain domain\n     * @param sslProvider SslProvider\n     */\n    public void addSslProvider(final String domain, final SslProvider sslProvider) {\n        sslProviderMap.put(domain, sslProvider);","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/apache/shenyu/blob/567142e07261b3e615ae8850b30f4421f455cc5d/shenyu-common/src/main/java/org/apache/shenyu/common/config/ssl/ShenyuSniAsyncMapping.java#L30-L66","documentation":"ShenyuSniAsyncMapping's parameterized constructor builds SNI SSL providers from a list of certificate/key files; a null or empty list means no SNI mapping could be created, so it throws ShenyuException('The sslCrtAndKeys can not be null'). The gateway needs at least one cert/key pair to construct Http11SslContextSpec entries for domain-based TLS routing.","triggerScenarios":"new ShenyuSniAsyncMapping(list) where list is null or isEmpty() — e.g. shenyu.sni.* configuration resolved to zero certificate entries.","commonSituations":"SNI enabled in bootstrap config but no crt/key file paths configured; a config loader returning an empty list when file globs match nothing; property names mistyped so cert entries aren't parsed.","solutions":["Configure at least one ssl cert/key pair (keyCertChainFile + keyFile) under the shenyu SNI settings before constructing the mapping.","Verify the file paths exist and are readable — next failure after an empty list is typically file-not-found.","Check the code path building the list (config parsing/filtering) for why it returned empty.","If SNI is not needed, avoid constructing ShenyuSniAsyncMapping with the empty list rather than passing it defensively."],"exampleFix":"// before\nList<SslCrtAndKeyFile> certs = sniConfig.getCerts(); // may be empty\nnew ShenyuSniAsyncMapping(certs);\n// after\nif (certs != null && !certs.isEmpty()) {\n    new ShenyuSniAsyncMapping(certs);\n} else {\n    LOG.warn(\"SNI disabled: no certificates configured\");\n}","handlingStrategy":"validation","validationCode":"if (sslCrtAndKeys == null || sslCrtAndKeys.isEmpty()) {\n    throw new IllegalArgumentException(\"at least one SNI cert/key pair is required\");\n}","typeGuard":"boolean hasCerts(List<SslCrtAndKeyFile> l) {\n    return l != null && !l.isEmpty();\n}","tryCatchPattern":"try {\n    new ShenyuSniAsyncMapping(certs);\n} catch (ShenyuException e) {\n    LOG.error(\"SNI init failed: {}\", e.getMessage());\n}","preventionTips":["Validate SNI cert config at startup before any SslProvider construction.","Log the number of cert entries parsed so empty resolution is visible.","Verify cert/key file paths exist and are readable in the target environment."],"tags":["tls","sni","ssl","config"],"backgroundTag":"empty-required-field","analyzedSha":"567142e07261b3e615ae8850b30f4421f455cc5d","analyzedAt":"2026-09-12T10:08:21.293Z","contentChangedAt":"2026-09-12T10:08:21.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}