coder/code-server · error · Error

--cert-key is missing

Error message

--cert-key is missing

What it means

When TLS is enabled with --cert, code-server requires the matching private key via --cert-key (cli.ts:490). A certificate alone cannot complete a TLS handshake, so the startup is aborted before binding the HTTPS listener.

Source

Thrown at src/node/cli.ts:490

          ;(args[key] as string) = value
          break
        }
      }

      continue
    }

    // Everything else goes into _.
    if (typeof args._ === "undefined") {
      args._ = []
    }

    args._.push(arg)
  }

  // If a cert was provided a key must also be provided.
  if (args.cert && args.cert.value && !args["cert-key"]) {
    throw new Error("--cert-key is missing")
  }

  logger.debug(() => [`parsed ${opts?.configFile ? "config" : "command line"}`, field("args", redactArgs(args))])

  return args
}

/**
 * Redact sensitive information from arguments for logging.
 */
export const redactArgs = (args: UserProvidedArgs): UserProvidedArgs => {
  return {
    ...args,
    password: args.password ? "<redacted>" : undefined,
    "hashed-password": args["hashed-password"] ? "<redacted>" : undefined,
    "github-auth": args["github-auth"] ? "<redacted>" : undefined,
  }
}

View on GitHub (pinned to 51f90a376b)

Solutions

1. Provide the key alongside the cert: `code-server --cert=server.crt --cert-key=server.key`
2. Verify both file paths exist and are readable by the code-server user
3. If you only have a combined PEM, split it into separate cert and key files

Example fix

# before
code-server --cert=/etc/ssl/server.crt

# after
code-server --cert=/etc/ssl/server.crt --cert-key=/etc/ssl/server.key

function validateTlsArgs(args: { cert?: string; "cert-key"?: string }): void {
  if (args.cert && !args["cert-key"]) {
    throw new Error("--cert requires --cert-key")
  }
  if (args.cert && !fs.existsSync(args.cert)) throw new Error(`cert not found: ${args.cert}`)
  if (args["cert-key"] && !fs.existsSync(args["cert-key"])) {
    throw new Error(`cert-key not found: ${args["cert-key"]}`)
  }
}

When it happens

Trigger: Launching `code-server --cert=/etc/ssl/server.crt` without also passing `--cert-key=...`, or passing an empty/undefined cert-key value.

Common situations: Setting up HTTPS with a Let's Encrypt cert and forgetting the .key path; reversing the two flags so cert-key is omitted.

Related errors

• --password can only be set in the config file or passed in v
• --hashed-password can only be set in the config file or pass
• --github-auth can only be set in the config file or passed i
• --idle-timeout-seconds must be greater than 60 seconds.
• No opened code-server instances found to handle ${paths[0]}

AI-assisted analysis of coder/code-server@51f90a376b (2026-08-12). Data as JSON: /api/errors/3ac35a98ca545e89. Report an issue: GitHub.