{"record":{"id":"e0f089874d528d9d","repo":"AlistGo/alist","slug":"ftp-mandatory-tls-has-been-enabled-but-the-certif","errorCode":null,"errorMessage":"FTP mandatory TLS has been enabled, but the certificate failed to load: %w","messagePattern":"FTP mandatory TLS has been enabled, but the certificate failed to load: %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"server/ftp.go","lineNumber":57,"sourceCode":"\t\ttransferType = ftpserver.TransferTypeBinary\n\t}\n\tactiveConnCheck := ftpserver.IPMatchDisabled\n\tif conf.Conf.FTP.EnableActiveConnIPCheck {\n\t\tactiveConnCheck = ftpserver.IPMatchRequired\n\t}\n\tpasvConnCheck := ftpserver.IPMatchDisabled\n\tif conf.Conf.FTP.EnablePasvConnIPCheck {\n\t\tpasvConnCheck = ftpserver.IPMatchRequired\n\t}\n\ttlsRequired := ftpserver.ClearOrEncrypted\n\tif setting.GetBool(conf.FTPImplicitTLS) {\n\t\ttlsRequired = ftpserver.ImplicitEncryption\n\t} else if setting.GetBool(conf.FTPMandatoryTLS) {\n\t\ttlsRequired = ftpserver.MandatoryEncryption\n\t}\n\ttlsConf, err := getTlsConf(setting.GetStr(conf.FTPTLSPrivateKeyPath), setting.GetStr(conf.FTPTLSPublicCertPath))\n\tif err != nil && tlsRequired != ftpserver.ClearOrEncrypted {\n\t\treturn nil, fmt.Errorf(\"FTP mandatory TLS has been enabled, but the certificate failed to load: %w\", err)\n\t}\n\treturn &FtpMainDriver{\n\t\tsettings: &ftpserver.Settings{\n\t\t\tListenAddr:                conf.Conf.FTP.Listen,\n\t\t\tPublicHost:                lookupIP(setting.GetStr(conf.FTPPublicHost)),\n\t\t\tPassiveTransferPortGetter: newPortMapper(setting.GetStr(conf.FTPPasvPortMap)),\n\t\t\tFindPasvPortAttempts:      conf.Conf.FTP.FindPasvPortAttempts,\n\t\t\tActiveTransferPortNon20:   conf.Conf.FTP.ActiveTransferPortNon20,\n\t\t\tIdleTimeout:               conf.Conf.FTP.IdleTimeout,\n\t\t\tConnectionTimeout:         conf.Conf.FTP.ConnectionTimeout,\n\t\t\tDisableMLSD:               false,\n\t\t\tDisableMLST:               false,\n\t\t\tDisableMFMT:               true,\n\t\t\tBanner:                    setting.GetStr(conf.Announcement),\n\t\t\tTLSRequired:               tlsRequired,\n\t\t\tDisableLISTArgs:           false,\n\t\t\tDisableSite:               false,\n\t\t\tDisableActiveMode:         conf.Conf.FTP.DisableActiveMode,","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/AlistGo/alist/blob/843d9dc8149126976b2625911e45a4d3ffd6f2f5/server/ftp.go#L39-L75","documentation":"server/ftp.go loads a TLS certificate from the configured FTP key/cert paths via getTlsConf. If loading fails while TLS is required (implicit TLS or mandatory encryption — i.e. tlsRequired != ClearOrEncrypted), the FTP server refuses to start with this wrapped error.","triggerScenarios":"Starting the FTP server with FTPImplicitTLS or FTPMandatoryTLS enabled while the private key/public cert paths are unset, point to missing files, contain an invalid PEM, or the key does not match the cert.","commonSituations":"Enabling FTP TLS in settings without first uploading/generating certificates; paths pointing to old/self-signed certs that expired into unreadable files; copy-pasting only one of the two PEM blocks.","solutions":["Set valid FTP TLS private key and public cert paths in settings and confirm both files exist and are readable","Validate the pair: openssl x509 -in cert.pem -noout -modulus vs openssl rsa -in key.pem -noout -modulus must match","Regenerate a self-signed cert if the old one is corrupt: openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365","Or relax the setting to ClearOrEncrypted if TLS is not actually required"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if tlsRequired != ftpserver.ClearOrEncrypted {\n    if _, err := tls.LoadX509KeyPair(certPath, keyPath); err != nil {\n        return fmt.Errorf(\"validate FTP cert pair before enabling TLS: %w\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate the cert/key pair with openssl before enabling FTP TLS","Store certificates at stable paths referenced by settings","Monitor cert expiry and rotate before renewal lapses"],"tags":["go","ftp","tls","certificate","configuration"],"backgroundTag":null,"analyzedSha":"843d9dc8149126976b2625911e45a4d3ffd6f2f5","analyzedAt":"2026-08-15T12:14:11.722Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}