{"record":{"id":"d035fe1443e6da67","repo":"linera-io/linera-protocol","slug":"tls-not-supported-between-proxy-and-shards","errorCode":null,"errorMessage":"TLS not supported between proxy and shards.","messagePattern":"TLS not supported between proxy and shards\\.","errorType":"validation","errorClass":"anyhow","httpStatus":null,"severity":"error","filePath":"linera-service/src/server.rs","lineNumber":359,"sourceCode":"            }\n        };\n\n        let mut join_set = match self.server_config.internal_network.protocol {\n            NetworkProtocol::Simple(protocol) => self.spawn_simple(\n                &listen_address,\n                states,\n                protocol,\n                &shutdown_notifier,\n                enable_memory_profiling,\n            ),\n            NetworkProtocol::Grpc(tls_config) => match tls_config {\n                TlsConfig::ClearText => self.spawn_grpc(\n                    &listen_address,\n                    states,\n                    &shutdown_notifier,\n                    enable_memory_profiling,\n                ),\n                TlsConfig::Tls => bail!(\"TLS not supported between proxy and shards.\"),\n            },\n        };\n\n        join_set.await_all_tasks().await;\n\n        Ok(())\n    }\n}\n\n#[derive(clap::Parser)]\n#[command(\n    name = \"linera-server\",\n    about = \"Server implementation (aka validator shard) for the Linera blockchain\",\n    version = linera_version::VersionInfo::default_clap_str(),\n)]\nstruct ServerOptions {\n    /// Subcommands. Acceptable values are run and generate.\n    #[command(subcommand)]","sourceCodeStart":341,"sourceCodeEnd":377,"githubUrl":"https://github.com/linera-io/linera-protocol/blob/6c226ddcb332ef55118dc8d0aafbd093d5420899/linera-service/src/server.rs#L341-L377","documentation":"Raised in `ServerContext::run` (linera-service server.rs) when the validator server's internal network is configured as `NetworkProtocol::Grpc(TlsConfig::Tls)`. The gRPC shards spawned by the server only support cleartext connections; TLS in a Linera deployment is terminated at the proxy's public side, never between proxy and shards. The server aborts at startup instead of running a half-supported TLS listener.","triggerScenarios":"Running `linera server` with `server_config.internal_network.protocol = Grpc(Tls)`; reusing a public/external TLS setting for the internal network section in config.toml.","commonSituations":"Hardening a deployment and mistakenly enabling TLS on the internal network; hand-editing config.toml and copying the external `grpc tls` block into `internal_network`; following generic gRPC TLS guidance that does not apply to proxy-to-shard links.","solutions":["Set `internal_network.protocol` to `grpc` with `tls = \"cleartext\"` in the server config","Keep TLS only on the validator's external/public protocol (terminated at the proxy)","Regenerate the config with the current linera-configgen to get valid defaults","Check the proxy config too — the proxy must connect to shards over cleartext gRPC"],"exampleFix":"# before (config.toml)\n[internal_network]\nprotocol = { type = \"grpc\", tls = \"tls\" }\n\n# after\n[internal_network]\nprotocol = { type = \"grpc\", tls = \"cleartext\" }","handlingStrategy":"validation","validationCode":"// Rust: reject TLS internal configs before starting the server\nmatch &server_config.internal_network.protocol {\n    NetworkProtocol::Grpc(TlsConfig::Tls) => {\n        return Err(anyhow::anyhow!(\n            \"internal network must be grpc cleartext; TLS terminates at the proxy\"\n        ));\n    }\n    _ => {}\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep TLS settings on the external/public protocol only — proxy-to-shard links are always cleartext gRPC","Review the internal_network block after any TLS hardening pass","Use configgen defaults for the internal network"],"tags":["tls","grpc","config","linera-server","validator"],"backgroundTag":"tls-configuration-unsupported","analyzedSha":"6c226ddcb332ef55118dc8d0aafbd093d5420899","analyzedAt":"2026-08-22T22:49:09.787Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}