{"record":{"id":"bec7947311df0197","repo":"sgl-project/sglang","slug":"enable-ssl-refresh-requires-ssl-certfile-and","errorCode":null,"errorMessage":"--enable-ssl-refresh requires --ssl-certfile and --ssl-keyfile to be specified.","messagePattern":"--enable-ssl-refresh requires --ssl-certfile and --ssl-keyfile to be specified\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"python/sglang/srt/server_args.py","lineNumber":4343,"sourceCode":"                )\n        # Validate files exist early to avoid late failures after model loading.\n        if cfg.ssl_keyfile and not os.path.isfile(cfg.ssl_keyfile):\n            raise ValueError(\n                f\"SSL key file not found: '{cfg.ssl_keyfile}'. \"\n                f\"Please check the --ssl-keyfile path.\"\n            )\n        if cfg.ssl_certfile and not os.path.isfile(cfg.ssl_certfile):\n            raise ValueError(\n                f\"SSL certificate file not found: '{cfg.ssl_certfile}'. \"\n                f\"Please check the --ssl-certfile path.\"\n            )\n        if cfg.ssl_ca_certs and not os.path.isfile(cfg.ssl_ca_certs):\n            raise ValueError(\n                f\"SSL CA certificates file not found: '{cfg.ssl_ca_certs}'. \"\n                f\"Please check the --ssl-ca-certs path.\"\n            )\n        if cfg.enable_ssl_refresh and not (cfg.ssl_certfile and cfg.ssl_keyfile):\n            raise ValueError(\n                \"--enable-ssl-refresh requires --ssl-certfile and --ssl-keyfile \"\n                \"to be specified.\"\n            )\n\n        if cfg.enable_http2:\n            if not 0 < cfg.http2_max_concurrent_streams < 2**32:\n                raise ValueError(\n                    \"--http2-max-concurrent-streams must be between 1 and \"\n                    \"4294967295.\"\n                )\n\n            try:\n                import granian  # noqa: F401\n            except ImportError:\n                raise ValueError(\n                    \"--enable-http2 requires the 'granian' package. \"\n                    'Install it with: pip install \"sglang[http2]\"'\n                )","sourceCodeStart":4325,"sourceCodeEnd":4361,"githubUrl":"https://github.com/sgl-project/sglang/blob/0132848349585cfe6aae51c4941cbae872505f8a/python/sglang/srt/server_args.py#L4325-L4361","documentation":"--enable-ssl-refresh enables hot-reloading of SSL certificates, which requires both a certificate and its private key to be configured. SGLang raises this error at argument validation when either --ssl-certfile or --ssl-keyfile is missing.","triggerScenarios":"Passing --enable-ssl-refresh without also passing both --ssl-certfile and --ssl-keyfile. Checked in _handle_ssl_validation during startup.","commonSituations":"Copy-pasted TLS config from another service that only set CA certs; assumed the refresh flag works with defaults; enabled rotation support but forgot the key file argument.","solutions":["Add --ssl-certfile /path/to/cert.pem and --ssl-keyfile /path/to/key.pem alongside --enable-ssl-refresh","Verify both files exist and are readable by the server process","If you do not need hot-reload, remove --enable-ssl-refresh"],"exampleFix":"# before\npython -m sglang.launch_server --enable-ssl-refresh\n# after\npython -m sglang.launch_server --enable-ssl-refresh --ssl-certfile /etc/ssl/cert.pem --ssl-keyfile /etc/ssl/key.pem","handlingStrategy":"validation","validationCode":"if args.enable_ssl_refresh and not (args.ssl_certfile and args.ssl_keyfile):\n    raise SystemExit('--enable-ssl-refresh requires --ssl-certfile and --ssl-keyfile')","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat TLS flags as one unit in config templates","Fail fast in wrapper scripts before invoking the server"],"tags":["ssl","tls","certificate-rotation","server-args"],"backgroundTag":"missing-required-config-option","analyzedSha":"0132848349585cfe6aae51c4941cbae872505f8a","analyzedAt":"2026-08-28T05:10:05.995Z","schemaVersion":2},"datasetVersion":"2026-08-28T06:17:29.519Z"}