{"record":{"id":"bf15b302c491a85a","repo":"denoland/deno","slug":"a-key-and-certificate-are-required-for-deno-liste","errorCode":null,"errorMessage":"A key and certificate are required for `Deno.listenTls`","messagePattern":"A key and certificate are required for `Deno\\.listenTls`","errorType":"validation","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"ext/net/02_tls.js","lineNumber":179,"sourceCode":"    return op_tls_key_null();\n  }\n}\n\nfunction listenTls({\n  port = 0,\n  hostname = \"0.0.0.0\",\n  transport = \"tcp\",\n  alpnProtocols = undefined,\n  reusePort = false,\n  tcpBacklog = 511,\n}) {\n  if (transport !== \"tcp\") {\n    throw new TypeError(`Unsupported transport: '${transport}'`);\n  }\n  port = validatePort(port, true);\n\n  if (!hasTlsKeyPairOptions(arguments[0])) {\n    throw new TypeError(\n      \"A key and certificate are required for `Deno.listenTls`\",\n    );\n  }\n  const keyPair = loadTlsKeyPair(\"Deno.listenTls\", arguments[0]);\n  const { 0: rid, 1: localAddr } = op_net_listen_tls(\n    { hostname, port },\n    { alpnProtocols, reusePort, tcpBacklog },\n    keyPair,\n  );\n  localAddr.transport = transport;\n  return new TlsListener(rid, localAddr);\n}\n\n// deno-lint-ignore require-await\nasync function startTls(\n  conn,\n  {\n    hostname = \"127.0.0.1\",","sourceCodeStart":161,"sourceCodeEnd":197,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/net/02_tls.js#L161-L197","documentation":"Deno.listenTls throws this TypeError when the options contain no key-pair material at all (hasTlsKeyPairOptions is false and no key resolver was registered). A TLS server must present a certificate, unlike Deno.connectTls where cert/key are optional client credentials. The check runs before the listening socket is created.","triggerScenarios":"Deno.listenTls({ port: 443 }); Deno.listenTls({ port: 443, keyFormat: 'pem' }) (a format alone is not a key pair); cert/key read asynchronously and passed as undefined; Node-style option names like pfx/passphrase that the API does not read.","commonSituations":"Assuming listenTls works like connectTls with no certificate; pointing at Let's Encrypt files with wrong paths so readTextFile never ran; local dev servers started before certificates were generated.","solutions":["Generate or obtain a PEM cert/key pair and pass both strings","For local dev create a self-signed pair: openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes","Load the files with await Deno.readTextFile before calling listenTls, and verify they are non-empty strings"],"exampleFix":"// before\nconst listener = Deno.listenTls({ port: 443 }); // no cert/key\n\n// after\nconst cert = await Deno.readTextFile('cert.pem');\nconst key = await Deno.readTextFile('key.pem');\nconst listener = Deno.listenTls({ port: 443, cert, key });","handlingStrategy":"validation","validationCode":"const cert = await Deno.readTextFile('cert.pem').catch(() => undefined);\nconst key = await Deno.readTextFile('key.pem').catch(() => undefined);\nif (!cert?.includes('BEGIN') || !key?.includes('BEGIN')) {\n  throw new Error('listenTls needs PEM cert and key; generate with openssl req -x509 -newkey rsa:2048');\n}","typeGuard":"function hasTlsKeyPairOptions(o: Record<string, unknown>): boolean {\n  return typeof (o as { cert?: unknown }).cert === 'string' &&\n    typeof (o as { key?: unknown }).key === 'string';\n}","tryCatchPattern":"try {\n  Deno.listenTls({ port, cert, key });\n} catch (e) {\n  if (e instanceof TypeError && e.message.includes('key and certificate are required')) {\n    throw new Error(`TLS cert/key missing or empty (cert=${!!cert}, key=${!!key})`);\n  }\n  throw e;\n}","preventionTips":["Run a startup preflight that loads and sanity-checks both PEM files before binding","Distinguish client and server roles: servers always need their own certificate","Include certificate renewal checks in ops tooling so cert/key never silently disappear"],"tags":["deno","tls","listen","certificate","typeerror"],"backgroundTag":"tls-certificate-configuration","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}