{"record":{"id":"ca7f29cb9a170a64","repo":"astrid-runtime/astrid","slug":"tls-cert-path-and-tls-key-path-resolve-to-the-same","errorCode":null,"errorMessage":"tls.cert-path and tls.key-path resolve to the same file ({}); separate them","messagePattern":"tls\\.cert-path and tls\\.key-path resolve to the same file \\((.+?)\\); separate them","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-gateway/src/config.rs","lineNumber":169,"sourceCode":"            // clear error.\n            if !tls.cert_path.is_file() {\n                anyhow::bail!(\n                    \"tls.cert-path {} is not a regular file — refusing to boot the gateway\",\n                    tls.cert_path.display()\n                );\n            }\n            if !tls.key_path.is_file() {\n                anyhow::bail!(\n                    \"tls.key-path {} is not a regular file — refusing to boot the gateway\",\n                    tls.key_path.display()\n                );\n            }\n            // Defensive: catch the copy-paste typo where cert+key\n            // point at the same file. The rustls PEM parser will\n            // happily try to load a private key out of the cert chain\n            // and produce a cryptic error; surface the problem here.\n            if tls.cert_path == tls.key_path {\n                anyhow::bail!(\n                    \"tls.cert-path and tls.key-path resolve to the same file ({}); separate them\",\n                    tls.cert_path.display()\n                );\n            }\n            crate::tls::warn_if_key_is_too_open(&tls.key_path);\n        }\n        Ok(())\n    }\n}\n\n/// Validate a single CORS origin string. Origins MUST be of the form\n/// `scheme://host[:port]` with no path, query, or fragment — that's\n/// what the browser sends in `Origin:` and what the response's\n/// `Access-Control-Allow-Origin:` is byte-matched against. A\n/// `https://app.example/` (trailing slash) would silently fail to\n/// match a real preflight; rejecting it here is what makes that\n/// surfacable.\nfn validate_cors_origin(raw: &str) -> anyhow::Result<()> {","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-gateway/src/config.rs#L151-L187","documentation":"Defensive check in GatewayConfig::validate: tls.cert-path and tls.key-path resolve to the same file — the classic copy-paste typo of pointing both at the certificate — which would make TLS unusable at handshake time.","triggerScenarios":"Thrown at crates/astrid-gateway/src/config.rs:169 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Point tls.key-path at the private-key PEM and tls.cert-path at the certificate PEM — two different files","If only one file exists, regenerate or export the missing half of the keypair","Re-check the config after templating/secret injection that may have collapsed both values"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}