{"record":{"id":"c0efbd7e5a87746f","repo":"goharbor/harbor","slug":"error-the-path-for-certificate-key-s-is-invalid","errorCode":null,"errorMessage":"Error: The path for certificate key: %s is invalid","messagePattern":"Error: The path for certificate key: (.+?) is invalid","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"make/photon/prepare/utils/misc.py","lineNumber":35,"sourceCode":"\n\ndef validate(conf, **kwargs):\n    # Protocol validate\n    protocol = conf.get(\"configuration\", \"ui_url_protocol\")\n    if protocol == \"https\":\n        if not conf.has_option(\"configuration\", \"ssl_cert\"):\n            raise Exception(\n                \"Error: The protocol is https but attribute ssl_cert is not set\")\n        cert_path = conf.get(\"configuration\", \"ssl_cert\")\n        if not os.path.isfile(cert_path):\n            raise Exception(\n                \"Error: The path for certificate: %s is invalid\" % cert_path)\n        if not conf.has_option(\"configuration\", \"ssl_cert_key\"):\n            raise Exception(\n                \"Error: The protocol is https but attribute ssl_cert_key is not set\")\n        cert_key_path = conf.get(\"configuration\", \"ssl_cert_key\")\n        if not os.path.isfile(cert_key_path):\n            raise Exception(\n                \"Error: The path for certificate key: %s is invalid\" % cert_key_path)\n\n    # Storage validate\n    valid_storage_drivers = [\"filesystem\",\n                             \"azure\", \"gcs\", \"s3\", \"swift\", \"oss\"]\n    storage_provider_name = conf.get(\n        \"configuration\", \"registry_storage_provider_name\").strip()\n    if storage_provider_name not in valid_storage_drivers:\n        raise Exception(\"Error: storage driver %s is not supported, only the following ones are supported: %s\" % (\n            storage_provider_name, \",\".join(valid_storage_drivers)))\n\n    storage_provider_config = conf.get(\n        \"configuration\", \"registry_storage_provider_config\").strip()\n    if storage_provider_name != \"filesystem\":\n        if storage_provider_config == \"\":\n            raise Exception(\n                \"Error: no provider configurations are provided for provider %s\" % storage_provider_name)\n","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/goharbor/harbor/blob/7b2fd08cc568955cca339afeefab27372840d936/make/photon/prepare/utils/misc.py#L17-L53","documentation":"Thrown by the legacy validator in make/photon/prepare/utils/misc.py when harbor.cfg sets ui_url_protocol = https and provides ssl_cert_key, but os.path.isfile(cert_key_path) is false - the configured private key path does not exist as a regular file where prepare looks for it. The same check runs for the certificate one line above; this raise is specifically the key path.","triggerScenarios":"harbor.cfg has 'ssl_cert_key = /cert/server.key' but the file is absent, is a directory, uses a relative path, or lives at a location not visible to the prepare environment. os.path.isfile returns False and the error embeds the offending path.","commonSituations":"Certificates not copied to the Harbor host before install; typos in paths; restoring harbor.cfg backups after the certs were rotated away; paths valid on an old server but different on the new one.","solutions":["Verify the path on the Harbor host: ls -l <ssl_cert_key value>","Fix the ssl_cert_key value in harbor.cfg to the absolute path of the existing key file","Confirm the key is a file, not a directory or symlink to a missing target","Re-run prepare/install"],"exampleFix":"# harbor.cfg (before)\nssl_cert_key = /cert/server.key      # file not there\n\n# after\nssl_cert_key = /data/cert/server.key  # exists: -rw------- 1 10000 10000","handlingStrategy":"validation","validationCode":"import configparser, os\nconf = configparser.ConfigParser()\nconf.read('harbor.cfg')\nif conf.get('configuration', 'ui_url_protocol') == 'https':\n    key = conf.get('configuration', 'ssl_cert_key')\n    if not os.path.isfile(key):\n        raise SystemExit('ssl_cert_key path invalid: %s' % key)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Copy TLS material to the host and verify with ls before flipping to https","Use absolute paths in harbor.cfg","Re-check paths after migrating harbor.cfg between servers"],"tags":["harbor","https","tls","file-system","legacy-config"],"backgroundTag":null,"analyzedSha":"7b2fd08cc568955cca339afeefab27372840d936","analyzedAt":"2026-08-16T00:00:10.961Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}