{"record":{"id":"b6ccb7b143c7b6bb","repo":"sgl-project/sglang","slug":"ssl-certificate-file-not-found-cfg-ssl-certfile","errorCode":null,"errorMessage":"SSL certificate file not found: '{cfg.ssl_certfile}'. Please check the --ssl-certfile path.","messagePattern":"SSL certificate file not found: '(.+?)'\\. Please check the --ssl-certfile path\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"python/sglang/srt/server_args.py","lineNumber":4333,"sourceCode":"                \"--ssl-certfile requires --ssl-keyfile to be specified as well.\"\n            )\n        if not cfg.ssl_certfile and not cfg.ssl_keyfile:\n            if cfg.ssl_ca_certs:\n                raise ValueError(\n                    \"--ssl-ca-certs has no effect without --ssl-certfile and --ssl-keyfile.\"\n                )\n            if cfg.ssl_keyfile_password:\n                raise ValueError(\n                    \"--ssl-keyfile-password has no effect without --ssl-certfile and --ssl-keyfile.\"\n                )\n        # Validate files exist early to avoid late failures after model loading.\n        if cfg.ssl_keyfile and not os.path.isfile(cfg.ssl_keyfile):\n            raise ValueError(\n                f\"SSL key file not found: '{cfg.ssl_keyfile}'. \"\n                f\"Please check the --ssl-keyfile path.\"\n            )\n        if cfg.ssl_certfile and not os.path.isfile(cfg.ssl_certfile):\n            raise ValueError(\n                f\"SSL certificate file not found: '{cfg.ssl_certfile}'. \"\n                f\"Please check the --ssl-certfile path.\"\n            )\n        if cfg.ssl_ca_certs and not os.path.isfile(cfg.ssl_ca_certs):\n            raise ValueError(\n                f\"SSL CA certificates file not found: '{cfg.ssl_ca_certs}'. \"\n                f\"Please check the --ssl-ca-certs path.\"\n            )\n        if cfg.enable_ssl_refresh and not (cfg.ssl_certfile and cfg.ssl_keyfile):\n            raise ValueError(\n                \"--enable-ssl-refresh requires --ssl-certfile and --ssl-keyfile \"\n                \"to be specified.\"\n            )\n\n        if cfg.enable_http2:\n            if not 0 < cfg.http2_max_concurrent_streams < 2**32:\n                raise ValueError(\n                    \"--http2-max-concurrent-streams must be between 1 and \"","sourceCodeStart":4315,"sourceCodeEnd":4351,"githubUrl":"https://github.com/sgl-project/sglang/blob/0132848349585cfe6aae51c4941cbae872505f8a/python/sglang/srt/server_args.py#L4315-L4351","documentation":"ServerArgs validation error raised when the file given by --ssl-certfile does not exist on disk. Like the key check, it runs during argument resolution so the server never gets to model loading with a broken TLS configuration.","triggerScenarios":"Launching with --ssl-certfile pointing to a nonexistent path: typo, wrong extension (.pem vs .crt), unmounted secret, or wrong directory.","commonSituations":"Cert filenames differing between staging and prod; cert-manager renewed under a new name; container mounts missing; copy-paste from a runbook with different layout.","solutions":["Fix the path: use an absolute path to the existing certificate file","Confirm the exact filename (ls the directory; check .crt vs .pem)","If containerized, verify the volume/secret is mounted at that path"],"exampleFix":"# before\n--ssl-certfile /certs/server.pem\n# after\n--ssl-certfile /etc/sglang/tls/server.crt","handlingStrategy":"validation","validationCode":"import os\n\ndef validate_ssl_paths(key: str | None, cert: str | None, ca: str | None) -> None:\n    if key and not os.path.isfile(key):\n        raise FileNotFoundError(key)\n    if cert and not os.path.isfile(cert):\n        raise FileNotFoundError(cert)\n    if ca and not os.path.isfile(ca):\n        raise FileNotFoundError(ca)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use absolute paths and verify filenames (.crt/.pem) with ls before launch","After cert rotation, confirm the new filename matches the configured flag","Preflight-check TLS mounts in container entrypoints"],"tags":["sglang","ssl","tls","file-not-found","deployment"],"backgroundTag":"ssl-certificate-file-not-found","analyzedSha":"0132848349585cfe6aae51c4941cbae872505f8a","analyzedAt":"2026-08-28T05:10:05.995Z","schemaVersion":2},"datasetVersion":"2026-08-28T06:17:29.519Z"}