{"record":{"id":"c0e7db167208f044","repo":"fatedier/frp","slug":"s-is-invalid-when-transport-tls-enable-is-false","errorCode":null,"errorMessage":"%s is invalid when transport.tls.enable is false","messagePattern":"(.+?) is invalid when transport\\.tls\\.enable is false","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/config/v1/validation/client.go","lineNumber":158,"sourceCode":"\treturn errs\n}\n\nfunc validateTransportConfig(c *v1.ClientTransportConfig) (Warning, error) {\n\tvar (\n\t\twarnings Warning\n\t\terrs     error\n\t)\n\n\tif c.HeartbeatTimeout > 0 && c.HeartbeatInterval > 0 {\n\t\tif c.HeartbeatTimeout < c.HeartbeatInterval {\n\t\t\terrs = AppendError(errs, fmt.Errorf(\"invalid transport.heartbeatTimeout, heartbeat timeout should not less than heartbeat interval\"))\n\t\t}\n\t}\n\n\tif !lo.FromPtr(c.TLS.Enable) {\n\t\tcheckTLSConfig := func(name string, value string) Warning {\n\t\t\tif value != \"\" {\n\t\t\t\treturn fmt.Errorf(\"%s is invalid when transport.tls.enable is false\", name)\n\t\t\t}\n\t\t\treturn nil\n\t\t}\n\n\t\twarnings = AppendError(warnings, checkTLSConfig(\"transport.tls.certFile\", c.TLS.CertFile))\n\t\twarnings = AppendError(warnings, checkTLSConfig(\"transport.tls.keyFile\", c.TLS.KeyFile))\n\t\twarnings = AppendError(warnings, checkTLSConfig(\"transport.tls.trustedCaFile\", c.TLS.TrustedCaFile))\n\t}\n\n\tif !slices.Contains(SupportedTransportProtocols, c.Protocol) {\n\t\terrs = AppendError(errs, fmt.Errorf(\"invalid transport.protocol, optional values are %v\", SupportedTransportProtocols))\n\t}\n\tif !slices.Contains(SupportedWireProtocols, c.WireProtocol) {\n\t\terrs = AppendError(errs, fmt.Errorf(\"invalid transport.wireProtocol, optional values are %v\", SupportedWireProtocols))\n\t}\n\treturn warnings, errs\n}\n","sourceCodeStart":140,"sourceCodeEnd":176,"githubUrl":"https://github.com/fatedier/frp/blob/6c8a8d0a97d03b44e9528d30b30c70cb9d61b405/pkg/config/v1/validation/client.go#L140-L176","documentation":"A warning (not fatal) emitted when transport.tls.enable is false (or unset) but TLS material fields are still set: certFile, keyFile, or trustedCaFile. The field name is interpolated into %s. frp tells you these values will be ignored because TLS is off.","triggerScenarios":"Client config contains transport.tls.certFile/keyFile/trustedCaFile paths while transport.tls.enable is false or omitted (defaults to false via lo.FromPtr on the pointer field).","commonSituations":"Disabling TLS temporarily (setting enable=false) while leaving cert paths in place; inheriting a shared config template that always includes TLS files; believing TLS is on by default.","solutions":["Set transport.tls.enable = true if you intend to use the configured certs","Or remove transport.tls.certFile/keyFile/trustedCaFile entries to silence the warning","Treat as non-fatal: frpc still starts, but TLS is genuinely disabled"],"exampleFix":"# before\n[transport.tls]\ncertFile = \"client.crt\"\nkeyFile = \"client.key\"\n# enable missing -> defaults false\n\n# after\n[transport.tls]\nenable = true\ncertFile = \"client.crt\"\nkeyFile = \"client.key\"","handlingStrategy":"validation","validationCode":"func tlsFieldsClean(c *v1.ClientTransportConfig) bool {\n    if lo.FromPtr(c.TLS.Enable) {\n        return true\n    }\n    return c.TLS.CertFile == \"\" && c.TLS.KeyFile == \"\" && c.TLS.TrustedCaFile == \"\"\n}","typeGuard":null,"tryCatchPattern":"if warn, _ := validation.ValidateClientCommonConfig(cfg); warn != nil {\n    log.Printf(\"config warnings: %v\", warn) // non-fatal; review TLS leftovers\n}","preventionTips":["Remove TLS material whenever disabling tls.enable instead of leaving it","Monitor warnings in startup logs, not just errors"],"tags":["frp","config","tls","transport","go"],"backgroundTag":null,"analyzedSha":"6c8a8d0a97d03b44e9528d30b30c70cb9d61b405","analyzedAt":"2026-08-15T06:53:27.215Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}