{"record":{"id":"dc2eae8861a95a1f","repo":"MemPalace/mempalace","slug":"tls-requires-both-tls-cert-and-tls-key-or-the","errorCode":null,"errorMessage":"TLS requires both --tls-cert and --tls-key (or the matching env vars)","messagePattern":"TLS requires both --tls-cert and --tls-key \\(or the matching env vars\\)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"mempalace/mcp_server.py","lineNumber":6822,"sourceCode":"# bind is loopback (skip the network-exposure warning) and to pin the Host\n# header against DNS rebinding when serving on loopback.\n_HTTP_LOOPBACK_HOSTS = (\"127.0.0.1\", \"localhost\", \"::1\", \"[::1]\")\n_HTTP_ALLOW_INSECURE_NO_TOKEN_ENV = \"MEMPALACE_MCP_HTTP_ALLOW_INSECURE_NO_TOKEN\"\n\n\ndef _resolve_tls_paths() -> tuple:\n    \"\"\"Resolve the TLS cert/key from --tls-cert/--tls-key or env, or (None, None).\n\n    Flags take precedence over ``MEMPALACE_MCP_TLS_CERT`` / ``MEMPALACE_MCP_TLS_KEY``.\n    Both must be given together; one without the other is a configuration error\n    (raised here, before any bind, so it fails loudly at startup).\n    \"\"\"\n    cert = (\n        getattr(_args, \"tls_cert\", None) or os.environ.get(\"MEMPALACE_MCP_TLS_CERT\", \"\")\n    ).strip()\n    key = (getattr(_args, \"tls_key\", None) or os.environ.get(\"MEMPALACE_MCP_TLS_KEY\", \"\")).strip()\n    if bool(cert) != bool(key):\n        raise ValueError(\"TLS requires both --tls-cert and --tls-key (or the matching env vars)\")\n    if not cert:\n        return None, None\n    for label, path in ((\"--tls-cert\", cert), (\"--tls-key\", key)):\n        if not os.path.isfile(path):\n            raise ValueError(f\"{label} file not found: {path!r}\")\n    return cert, key\n\n\ndef _wrap_tls(sock, cert: str, key: str):\n    \"\"\"Wrap a server socket in a TLS 1.2+ context. Raises on bad cert/key.\"\"\"\n    import ssl\n\n    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)\n    ctx.minimum_version = ssl.TLSVersion.TLSv1_2\n    ctx.load_cert_chain(certfile=cert, keyfile=key)\n    return ctx.wrap_socket(sock, server_side=True)\n\n","sourceCodeStart":6804,"sourceCodeEnd":6840,"githubUrl":"https://github.com/MemPalace/mempalace/blob/06cb6987f02610784fefbad4b2bd5d026d164ba6/mempalace/mcp_server.py#L6804-L6840","documentation":"Error \"TLS requires both --tls-cert and --tls-key (or the matching env vars)\" thrown in MemPalace/mempalace.","triggerScenarios":"Thrown at mempalace/mcp_server.py:6822 when the library encounters an invalid state.","commonSituations":"Only one of the TLS certificate/key pair was configured.","solutions":["Provide both --tls-cert and --tls-key (or set both matching env vars)"],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"06cb6987f02610784fefbad4b2bd5d026d164ba6","analyzedAt":"2026-08-15T03:03:36.213Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}