{"record":{"id":"bf0a358e7eff7e19","repo":"microsoft/garnet","slug":"cannot-provide-sslclientauthenticationoptions-when","errorCode":null,"errorMessage":"Cannot provide SslClientAuthenticationOptions when TLS is disabled","messagePattern":"Cannot provide SslClientAuthenticationOptions when TLS is disabled","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"libs/common/Networking/NetworkHandler.cs","lineNumber":218,"sourceCode":"                logger?.LogWarning(ex, \"An error has occurred\");\n                readerStatus = TlsReaderStatus.Rest;\n                if (expectingData.CurrentCount == 0) expectingData.Release();\n                Dispose();\n                throw;\n            }\n        }\n\n        /// <summary>\n        /// Begin (background) network handler.\n        /// \n        /// Blocks until auth completes.\n        /// </summary>\n        public virtual void Start(SslClientAuthenticationOptions tlsOptions, string remoteEndpointName = null, CancellationToken token = default)\n        {\n            if (tlsOptions != null && sslStream == null)\n                throw new Exception(\"Need to provide SslClientAuthenticationOptions when TLS is enabled\");\n            if (tlsOptions == null && sslStream != null)\n                throw new Exception(\"Cannot provide SslClientAuthenticationOptions when TLS is disabled\");\n            if (tlsOptions == null && sslStream == null) return;\n\n            // Can't use SslStream's sync methods for auth, so we must block\n            AsyncUtils.BlockingWait(AuthenticateAsClientAsync(tlsOptions, remoteEndpointName, token));\n        }\n\n        /// <summary>\n        /// Begin async network handler (including auth).\n        /// \n        /// When tasks completes, authentication has also completed.\n        /// </summary>\n        public virtual async Task StartAsync(SslClientAuthenticationOptions tlsOptions, string remoteEndpointName = null, CancellationToken token = default)\n        {\n            if (tlsOptions != null && sslStream == null)\n                throw new Exception(\"Need to provide SslClientAuthenticationOptions when TLS is enabled\");\n            if (tlsOptions == null && sslStream != null)\n                throw new Exception(\"Cannot provide SslClientAuthenticationOptions when TLS is disabled\");\n            if (tlsOptions == null && sslStream == null) return;","sourceCodeStart":200,"sourceCodeEnd":236,"githubUrl":"https://github.com/microsoft/garnet/blob/951b0fc6838721f89d102c2bbe1b914e8d39d700/libs/common/Networking/NetworkHandler.cs#L200-L236","documentation":"Thrown by the client-side NetworkHandler.Start when tlsOptions is null but the handler is TLS-enabled (sslStream != null). A TLS client handler cannot authenticate without SslClientAuthenticationOptions, so omitting them is a configuration contradiction.","triggerScenarios":"Constructing a client handler with an SslStream, then calling Start() with null client auth options.","commonSituations":"TLS client handler created but the caller forgets to pass SslClientAuthenticationOptions; a config read returning null options for a TLS-capable client.","solutions":["Always supply non-null SslClientAuthenticationOptions when the client handler is TLS-enabled.","Validate options presence before calling Start.","Fail fast at config load if client TLS is enabled but options are missing."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Ensure a TLS-enabled client handler gets non-null options\nif (handler.IsTlsEnabled && tlsOpts == null)\n    throw new InvalidOperationException(\"TLS-enabled client handler requires SslClientAuthenticationOptions\");\nhandler.Start(tlsOpts, remoteEndpointName, token);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always supply SslClientAuthenticationOptions for TLS-enabled client handlers.","Fail fast at config load if client TLS is on but options are missing.","Keep sync and async client start paths receiving the same options."],"tags":["network","tls","client","config","garnet"],"backgroundTag":null,"analyzedSha":"951b0fc6838721f89d102c2bbe1b914e8d39d700","analyzedAt":"2026-08-13T19:01:32.939Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}