{"record":{"id":"c90e6aabcd695b2f","repo":"nsqio/nsq","slug":"cannot-require-tls-client-connections-without-tls","errorCode":null,"errorMessage":"cannot require TLS client connections without TLS key and cert","messagePattern":"cannot require TLS client connections without TLS key and cert","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nsqd/nsqd.go","lineNumber":128,"sourceCode":"\n\tif opts.MaxDeflateLevel < 1 || opts.MaxDeflateLevel > 9 {\n\t\treturn nil, errors.New(\"--max-deflate-level must be [1,9]\")\n\t}\n\n\tif opts.ID < 0 || opts.ID >= 1024 {\n\t\treturn nil, errors.New(\"--node-id must be [0,1024)\")\n\t}\n\n\tif opts.TLSClientAuthPolicy != \"\" && opts.TLSRequired == TLSNotRequired {\n\t\topts.TLSRequired = TLSRequired\n\t}\n\n\ttlsConfig, err := buildTLSConfig(opts)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to build TLS config - %s\", err)\n\t}\n\tif tlsConfig == nil && opts.TLSRequired != TLSNotRequired {\n\t\treturn nil, errors.New(\"cannot require TLS client connections without TLS key and cert\")\n\t}\n\tn.tlsConfig = tlsConfig\n\n\tclientTLSConfig, err := buildClientTLSConfig(opts)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to build client TLS config - %s\", err)\n\t}\n\tn.clientTLSConfig = clientTLSConfig\n\n\tif opts.AuthHTTPRequestMethod != \"post\" && opts.AuthHTTPRequestMethod != \"get\" {\n\t\treturn nil, errors.New(\"--auth-http-request-method must be post or get\")\n\t}\n\n\tfor _, v := range opts.E2EProcessingLatencyPercentiles {\n\t\tif v <= 0 || v > 1 {\n\t\t\treturn nil, fmt.Errorf(\"invalid E2E processing latency percentile: %v\", v)\n\t\t}\n\t}","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/nsqio/nsq/blob/85cf10c09c6c3c86160d6f0eb156f62d0efc1648/nsqd/nsqd.go#L110-L146","documentation":"buildTLSConfig returns a nil config when no certificate/key pair was supplied. If TLS is nonetheless mandatory - --tls-required=true, or --tls-client-auth-policy set which implicitly upgrades TLSRequired from TLSNotRequired to TLSRequired - nsqd.New fails with this error rather than starting a server that would immediately reject or mis-handle TLS connections.","triggerScenarios":"Configuring --tls-required=true (or TLS_REQUIRED env / opts) without --tls-cert and --tls-key; setting --tls-client-auth-policy=require while forgetting the server certificate; enabling TLS in a config file whose cert/key paths section was dropped.","commonSituations":"Security hardening passes that flip the require flag before provisioning certs; cert rotation scripts that leave flags in place but files absent; container images that mount certs at a different path than the flags declare.","solutions":["Provide the pair: --tls-cert=/etc/nsq/cert.pem --tls-key=/etc/nsq/key.pem (files must be readable by the nsqd user).","Or drop the requirement: remove --tls-required and --tls-client-auth-policy if TLS is not actually needed.","Verify with openssl s_client -connect host:4150 -tls1 after restart to confirm the listener now speaks TLS."],"exampleFix":"# before\nnsqd --tls-required=true\n# after\nnsqd --tls-required=true --tls-cert=/etc/nsq/cert.pem --tls-key=/etc/nsq/key.pem","handlingStrategy":"validation","validationCode":"needsTLS := opts.TLSRequired != nsqd.TLSNotRequired || opts.TLSClientAuthPolicy != \"\"\nif needsTLS && (opts.TLSCert == \"\" || opts.TLSKey == \"\") {\n\treturn errors.New(\"TLS required but cert/key not configured\")\n}\n// also preflight the pair\nif _, err := tls.LoadX509KeyPair(opts.TLSCert, opts.TLSKey); needsTLS && err != nil {\n\treturn fmt.Errorf(\"bad TLS pair: %w\", err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Deploy cert/key and the require flags as one atomic config unit; never flip --tls-required in a separate change.","Health-check the TLS port (openssl s_client) after every cert rotation."],"tags":["nsq","nsqd","cli","config","tls"],"backgroundTag":null,"analyzedSha":"85cf10c09c6c3c86160d6f0eb156f62d0efc1648","analyzedAt":"2026-08-16T00:53:05.009Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}