{"record":{"id":"fdf430b9a0f5b6bb","repo":"sgl-project/sglang","slug":"ssl-ca-certs-has-no-effect-without-ssl-certfil","errorCode":null,"errorMessage":"--ssl-ca-certs has no effect without --ssl-certfile and --ssl-keyfile.","messagePattern":"--ssl-ca-certs has no effect without --ssl-certfile and --ssl-keyfile\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"python/sglang/srt/server_args.py","lineNumber":4319,"sourceCode":"                    else \"round_robin\"\n                ),\n            )\n            return\n\n    def _handle_ssl_validation(self):\n        \"\"\"Ensure SSL arguments are consistent and referenced files exist.\"\"\"\n        cfg = resolving_view(self)\n        if cfg.ssl_keyfile and not cfg.ssl_certfile:\n            raise ValueError(\n                \"--ssl-keyfile requires --ssl-certfile to be specified as well.\"\n            )\n        if cfg.ssl_certfile and not cfg.ssl_keyfile:\n            raise ValueError(\n                \"--ssl-certfile requires --ssl-keyfile to be specified as well.\"\n            )\n        if not cfg.ssl_certfile and not cfg.ssl_keyfile:\n            if cfg.ssl_ca_certs:\n                raise ValueError(\n                    \"--ssl-ca-certs has no effect without --ssl-certfile and --ssl-keyfile.\"\n                )\n            if cfg.ssl_keyfile_password:\n                raise ValueError(\n                    \"--ssl-keyfile-password has no effect without --ssl-certfile and --ssl-keyfile.\"\n                )\n        # Validate files exist early to avoid late failures after model loading.\n        if cfg.ssl_keyfile and not os.path.isfile(cfg.ssl_keyfile):\n            raise ValueError(\n                f\"SSL key file not found: '{cfg.ssl_keyfile}'. \"\n                f\"Please check the --ssl-keyfile path.\"\n            )\n        if cfg.ssl_certfile and not os.path.isfile(cfg.ssl_certfile):\n            raise ValueError(\n                f\"SSL certificate file not found: '{cfg.ssl_certfile}'. \"\n                f\"Please check the --ssl-certfile path.\"\n            )\n        if cfg.ssl_ca_certs and not os.path.isfile(cfg.ssl_ca_certs):","sourceCodeStart":4301,"sourceCodeEnd":4337,"githubUrl":"https://github.com/sgl-project/sglang/blob/0132848349585cfe6aae51c4941cbae872505f8a/python/sglang/srt/server_args.py#L4301-L4337","documentation":"ServerArgs validation error raised when --ssl-ca-certs is set but neither --ssl-certfile nor --ssl-keyfile is. CA certs only matter for verifying clients/peers once server TLS is enabled; without the key/cert pair they are inert, so SGLang fails fast to surface the misconfiguration.","triggerScenarios":"Launching with --ssl-ca-certs ca.pem and no --ssl-certfile/--ssl-keyfile.","commonSituations":"Attempting client-CA verification without enabling server TLS; leftover flag after disabling TLS; misunderstanding that ca-certs alone does not turn on HTTPS.","solutions":["Enable server TLS: add both --ssl-certfile and --ssl-keyfile alongside --ssl-ca-certs","If TLS is intentionally off, remove --ssl-ca-certs"],"exampleFix":"# before\n--ssl-ca-certs ca.pem\n# after\n--ssl-certfile server.crt --ssl-keyfile server.key --ssl-ca-certs ca.pem","handlingStrategy":"validation","validationCode":"def ca_certs_allowed(cert: str | None, key: str | None, ca: str | None) -> bool:\n    return not ca or bool(cert and key)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only set --ssl-ca-certs in the same config block that enables --ssl-certfile/--ssl-keyfile","Use a single tls_enabled toggle in deployment tooling that derives all four SSL flags"],"tags":["sglang","ssl","tls","argument-validation"],"backgroundTag":"ssl-certificate-configuration","analyzedSha":"0132848349585cfe6aae51c4941cbae872505f8a","analyzedAt":"2026-08-28T05:10:05.995Z","schemaVersion":2},"datasetVersion":"2026-08-28T06:17:29.519Z"}