cloudflare/pingora · error
No tls feature was specified
Error message
No tls feature was specified
What it means
pingora-core compiles even without any TLS provider feature (openssl, boringssl, rustls, s2n) by substituting the no-op TLS stubs in protocols/tls/noop_tls. The stubs keep the type surface compiling but cannot perform real crypto, so the stub listeners::Acceptor::tls_handshake() panics with unimplemented!("No tls feature was specified") the first time a TLS connection is accepted. Note the asymmetry: the no-op outbound connector silently returns a fake stream, while the inbound accept path panics.
Source
Thrown at pingora-core/src/protocols/tls/noop_tls/mod.rs:102
impl TlsSettings {
pub fn build(&self) -> Acceptor {
Acceptor
}
pub fn intermediate(_: &str, _: &str) -> Result<Self> {
Ok(Self)
}
pub fn enable_h2(&mut self) {}
pub fn set_offload_threadpool(&mut self, _: usize, _: usize) {}
pub fn set_offload_threadpool_from_server_conf(&mut self, _: &ServerConf) {}
}
impl Acceptor {
pub async fn tls_handshake<S: AsyncRead + AsyncWrite>(&self, _: S) -> Result<SslStream<S>> {
unimplemented!("No tls feature was specified")
}
}
}
pub mod stream {
use std::{
pin::Pin,
task::{Context, Poll},
};
use async_trait::async_trait;
use tokio::io::{AsyncRead, AsyncWrite, ReadBuf};
use crate::protocols::{
GetProxyDigest, GetSocketDigest, GetTimingDigest, Peek, Shutdown, Ssl, UniqueID,
};
/// A TLS session over a stream.View on GitHub (pinned to 0046038bd4)
Solutions
- Enable exactly one TLS provider feature, e.g. pingora-core = { version = "0.8", features = ["openssl"] } (alternatives: rustls, boringssl, s2n)
- Verify what is compiled in: cargo tree -e features | grep -E 'openssl|rustls|boringssl|s2n'
- If TLS is genuinely not needed, remove the TLS acceptor/listener setup so the stub Acceptor is never reached
Example fix
// before
pingora-core = { version = "0.8", default-features = false }
// after
pingora-core = { version = "0.8", default-features = false, features = ["rustls"] }
// or simply keep the default openssl provider:
pingora-core = "0.8" Defensive patterns
Strategy: validation
Prevention
- Never strip pingora's default features without explicitly enabling openssl, rustls, boringssl, or s2n
- After dependency changes run cargo tree -e features and confirm a TLS provider still reaches pingora-core
- Add a CI integration test that completes one loopback TLS handshake through your listener so a missing provider fails the build, not production
- Remember the no-op outbound connector silently returns a fake stream: smoke-test upstream HTTPS too, not just termination
When it happens
Trigger: A binary built from pingora-core with no TLS feature enabled creates an Acceptor via TlsSettings::intermediate(cert, key).build() and accepts a connection: the accept path calls Acceptor::tls_handshake() (noop_tls/mod.rs:102) and panics immediately.
Common situations: Declaring the pingora dependency with default-features = false without re-enabling a TLS feature; a workspace refactor where feature unification from another crate previously pulled openssl in and later dropped it; running the TLS example binaries without cargo run -F openssl.
Understand the failure class
- SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
Related errors
- Failed to build listeners
- Failed to parse certificate from DER format.
- Failed to parse certificate from DER format.
- Failed to parse PEM
- invalid argument
AI-assisted analysis of cloudflare/pingora@0046038bd4 (2026-08-16).
Data as JSON: /api/errors/6a254bc0ec0ee39b.
Report an issue: GitHub.