astrid-runtime/astrid · error

tls.key-path is not a regular file — refusing to boot the…

Error message

tls.key-path {} is not a regular file — refusing to boot the gateway

What it means

TLS configuration guard in GatewayConfig::validate: the configured tls.key-path exists but is not a regular file (a directory, or otherwise non-file entry). The comment notes is_file() is used deliberately over exists() so both missing and directory cases are caught here with a clear message instead of failing later inside the rustls PEM parser with a bewildering error.

Solutions

1. Correct tls.key-path in the gateway config to point at the PEM private-key file
2. Check that the key file exists and is a regular file
3. Fix permissions/mounts if the key file was moved or not deployed

When it happens

Trigger: Thrown at crates/astrid-gateway/src/config.rs:159 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/3bfd8bebd3d5c9fe. Report an issue: GitHub.

Appendix: source

Thrown at crates/astrid-gateway/src/config.rs:159

    ///   that the rustls PEM parser would surface as bewildering
    ///   downstream errors.
    pub fn validate(&self) -> anyhow::Result<()> {
        for raw in &self.cors_allow_origins {
            validate_cors_origin(raw)?;
        }
        if let Some(tls) = &self.tls {
            // `is_file()` catches both "doesn't exist" and "points
            // at a directory". `exists()` alone would pass for a
            // directory and fail later inside rustls with a less
            // clear error.
            if !tls.cert_path.is_file() {
                anyhow::bail!(
                    "tls.cert-path {} is not a regular file — refusing to boot the gateway",
                    tls.cert_path.display()
                );
            }
            if !tls.key_path.is_file() {
                anyhow::bail!(
                    "tls.key-path {} is not a regular file — refusing to boot the gateway",
                    tls.key_path.display()
                );
            }
            // Defensive: catch the copy-paste typo where cert+key
            // point at the same file. The rustls PEM parser will
            // happily try to load a private key out of the cert chain
            // and produce a cryptic error; surface the problem here.
            if tls.cert_path == tls.key_path {
                anyhow::bail!(
                    "tls.cert-path and tls.key-path resolve to the same file ({}); separate them",
                    tls.cert_path.display()
                );
            }
            crate::tls::warn_if_key_is_too_open(&tls.key_path);
        }
        Ok(())
    }

View on GitHub (pinned to affd8760f4)