astrid-runtime/astrid · error

tls.cert-path is not a regular file — refusing to boot the…

Error message

tls.cert-path {} is not a regular file — refusing to boot the gateway

What it means

Boot-time config validation in GatewayConfig::validate: tls.cert-path either does not exist or points at a directory; is_file() catches both, refusing to boot rather than failing later inside the rustls PEM parser with an obscure error.

Solutions

1. Correct the tls.cert-path in the gateway config to point at the PEM certificate file
2. Verify the path exists and is a regular file, not a directory
3. Copy or mount the certificate to the expected location if it is missing

When it happens

Trigger: Thrown at crates/astrid-gateway/src/config.rs:153 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/42d328e96b4d81cd. Report an issue: GitHub.

Appendix: source

Thrown at crates/astrid-gateway/src/config.rs:153

    /// * **CORS origins** are checked against the `scheme://host[:port]`
    ///   shape so an operator who typoed a trailing slash, fragment,
    ///   IDN, etc., fails boot with a clear message rather than
    ///   silently never matching a browser preflight.
    /// * **TLS** cert/key paths must exist as regular files and not
    ///   collide with each other — both common misconfigurations
    ///   that the rustls PEM parser would surface as bewildering
    ///   downstream errors.
    pub fn validate(&self) -> anyhow::Result<()> {
        for raw in &self.cors_allow_origins {
            validate_cors_origin(raw)?;
        }
        if let Some(tls) = &self.tls {
            // `is_file()` catches both "doesn't exist" and "points
            // at a directory". `exists()` alone would pass for a
            // directory and fail later inside rustls with a less
            // clear error.
            if !tls.cert_path.is_file() {
                anyhow::bail!(
                    "tls.cert-path {} is not a regular file — refusing to boot the gateway",
                    tls.cert_path.display()
                );
            }
            if !tls.key_path.is_file() {
                anyhow::bail!(
                    "tls.key-path {} is not a regular file — refusing to boot the gateway",
                    tls.key_path.display()
                );
            }
            // Defensive: catch the copy-paste typo where cert+key
            // point at the same file. The rustls PEM parser will
            // happily try to load a private key out of the cert chain
            // and produce a cryptic error; surface the problem here.
            if tls.cert_path == tls.key_path {
                anyhow::bail!(
                    "tls.cert-path and tls.key-path resolve to the same file ({}); separate them",
                    tls.cert_path.display()

View on GitHub (pinned to affd8760f4)