{"record":{"id":"d0aa9a43775b1cc4","repo":"jaegertracing/jaeger","slug":"server-with-tls-enabled-can-not-use-same-host-port","errorCode":null,"errorMessage":"server with TLS enabled can not use same host ports for gRPC and HTTP.  Use dedicated HTTP and gRPC host ports instead","messagePattern":"server with TLS enabled can not use same host ports for gRPC and HTTP\\.  Use dedicated HTTP and gRPC host ports instead","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/jaeger/internal/extension/jaegerquery/internal/server.go","lineNumber":77,"sourceCode":"\tquerySvc *querysvc.QueryService,\n\tmetricsQuerySvc metricstore.Reader,\n\toptions *QueryOptions,\n\tbackendCaps BackendCapabilityProvider,\n\ttm *tenancy.Manager,\n\ttelset telemetry.Settings,\n) (*Server, error) {\n\t_, httpPort, err := net.SplitHostPort(options.HTTP.NetAddr.Endpoint)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid HTTP server host:port: %w\", err)\n\t}\n\t_, grpcPort, err := net.SplitHostPort(options.GRPC.NetAddr.Endpoint)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid gRPC server host:port: %w\", err)\n\t}\n\tseparatePorts := grpcPort != httpPort || grpcPort == \"0\" || httpPort == \"0\"\n\n\tif (options.HTTP.TLS.HasValue() || options.GRPC.TLS.HasValue()) && !separatePorts {\n\t\treturn nil, errors.New(\"server with TLS enabled can not use same host ports for gRPC and HTTP.  Use dedicated HTTP and gRPC host ports instead\")\n\t}\n\n\tgrpcServer, err := createGRPCServer(ctx, options, tm, telset)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tregisterGRPCHandlers(grpcServer, querySvc, telset)\n\thttpServer, err := createHTTPServer(ctx, querySvc, metricsQuerySvc, options, backendCaps, tm, telset)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn &Server{\n\t\tqueryOptions: options,\n\t\tgrpcServer:   grpcServer,\n\t\thttpServer:   httpServer,\n\t\ttelset:       telset,\n\t}, nil","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/jaegertracing/jaeger/blob/806f4447841ecdb60519f408b004a599d515f437/cmd/jaeger/internal/extension/jaegerquery/internal/server.go#L59-L95","documentation":"NewServer refuses to start the jaegerquery extension when TLS is enabled for HTTP and/or gRPC while both protocols are configured on the same host:port. With TLS there is no way to demultiplex gRPC and HTTP on one listener in this setup, so the server fails fast at construction with this configuration error rather than misbehaving at runtime.","triggerScenarios":"Configuring the query extension with a single --query.http-server.host-port / --query.grpc-server.host-port sharing the same port while --query.http-server.tls.enabled and/or --query.grpc-server.tls.enabled is true (e.g. both set to :16686).","commonSituations":"Enabling TLS via config/env on an existing single-port deployment that relied on port sharing; copy-pasting the same host:port for both HTTP and gRPC sections; switching to TLS after migrating config and forgetting to split the ports.","solutions":["Assign distinct host:ports to the HTTP and gRPC servers (e.g. HTTP :16686, gRPC :16685) in the query extension config.","If you intentionally want one port, disable TLS on at least the side that must share (not recommended in production).","A port of \"0\" is treated as separate (auto-assign); ensure you did not expect TLS port-sharing to work like the non-TLS single-port mode."],"exampleFix":"// before: shared port with TLS\nhttp-server:\n  host-port: \":16686\"\n  tls: {enabled: true}\ngrpc-server:\n  host-port: \":16686\"  # same port -> error\n// after\nhttp-server:\n  host-port: \":16686\"\n  tls: {enabled: true}\ngrpc-server:\n  host-port: \":16685\"\n  tls: {enabled: true}","handlingStrategy":"validation","validationCode":"func validatePorts(httpHP, grpcHP string, httpTLS, grpcTLS bool) error {\n    hp, _ := net.SplitHostPort(httpHP)\n    gp, _ := net.SplitHostPort(grpcHP)\n    same := hp == gp && hp != \"0\"\n    if (httpTLS || grpcTLS) && same {\n        return errors.New(\"TLS requires distinct HTTP and gRPC host:ports\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"srv, err := server.NewServer(ctx, opts, tm, telset)\nif err != nil {\n    if strings.Contains(err.Error(), \"same host ports\") {\n        return fmt.Errorf(\"config error: split query.http-server.host-port and query.grpc-server.host-port before enabling TLS\")\n    }\n    return err\n}","preventionTips":["Use different ports by convention (16686 HTTP, 16685 gRPC) in every environment.","When enabling TLS, audit the whole query extension config, not just the TLS sections.","Add a startup smoke test to CI that constructs the server with your production config."],"tags":["configuration","tls","startup"],"backgroundTag":"tls-config-invalid","analyzedSha":"806f4447841ecdb60519f408b004a599d515f437","analyzedAt":"2026-09-01T02:39:22.140Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}