{"record":{"id":"f024b52c167f3c40","repo":"sigoden/dufs","slug":"no-tls-cert-set","errorCode":null,"errorMessage":"No tls-cert set","messagePattern":"No tls-cert set","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/args.rs","lineNumber":446,"sourceCode":"\n        if let Some(compress) = matches.get_one::<Compress>(\"compress\") {\n            args.compress = *compress;\n        }\n\n        #[cfg(feature = \"tls\")]\n        {\n            if let Some(tls_cert) = matches.get_one::<PathBuf>(\"tls-cert\") {\n                args.tls_cert = Some(tls_cert.clone())\n            }\n\n            if let Some(tls_key) = matches.get_one::<PathBuf>(\"tls-key\") {\n                args.tls_key = Some(tls_key.clone())\n            }\n\n            match (&args.tls_cert, &args.tls_key) {\n                (Some(_), Some(_)) => {}\n                (Some(_), _) => bail!(\"No tls-key set\"),\n                (_, Some(_)) => bail!(\"No tls-cert set\"),\n                (None, None) => {}\n            }\n        }\n        #[cfg(not(feature = \"tls\"))]\n        {\n            args.tls_cert = None;\n            args.tls_key = None;\n        }\n\n        Ok(args)\n    }\n\n    fn sanitize_path<P: AsRef<Path>>(path: P) -> Result<PathBuf> {\n        let path = path.as_ref();\n        if !path.exists() {\n            bail!(\"Path `{}` doesn't exist\", path.display());\n        }\n","sourceCodeStart":428,"sourceCodeEnd":464,"githubUrl":"https://github.com/sigoden/dufs/blob/fe7fd564f80dfbac361c8e0589c3845638149d38/src/args.rs#L428-L464","documentation":"The mirror case of the tls-key check: Args::parse in src/args.rs bails with 'No tls-cert set' when --tls-key is provided without --tls-cert. A private key without a certificate cannot establish a TLS identity, so the parser rejects the combination at startup.","triggerScenarios":"Running dufs with --tls-key <path> but omitting --tls-cert <path>; the (None, Some(_)) arm of the TLS match bails.","commonSituations":"Script templating only substituted the key path; user confused --tls-cert with a cert directory flag and thought it was optional; partial migration from an HTTP setup.","solutions":["Add --tls-cert pointing to the PEM certificate (or full chain) file","If you only wanted the key, you also need the cert — obtain/generate one (e.g. mkcert, Let's Encrypt)","Remove --tls-key if HTTPS was not intended"],"exampleFix":"# before\ndufs ./assets --tls-key key.pem\n# after\ndufs ./assets --tls-cert cert.pem --tls-key key.pem","handlingStrategy":"validation","validationCode":"# shell pre-check\nif [ -n \"$TLS_KEY\" ] && [ -z \"$TLS_CERT\" ]; then echo \"--tls-cert is required with --tls-key\"; exit 1; fi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass --tls-cert and --tls-key together","Generate cert+key with the same tool (mkcert, openssl, certbot) and store them side by side","Template both paths together in deployment scripts"],"tags":["cli","tls","rust","configuration","missing-argument"],"backgroundTag":"missing-required-flag","analyzedSha":"fe7fd564f80dfbac361c8e0589c3845638149d38","analyzedAt":"2026-09-09T13:01:22.843Z","contentChangedAt":"2026-09-09T13:01:22.843Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}