{"id":"1fda7c882c41f821","repo":"gofiber/fiber","slug":"tls-autocertmanager-cannot-be-combined-with-certf","errorCode":null,"errorMessage":"tls: AutoCertManager cannot be combined with CertFile/CertKeyFile","messagePattern":"tls: AutoCertManager cannot be combined with CertFile/CertKeyFile","errorType":"exception","errorClass":"ErrAutoCertWithCertFile","httpStatus":null,"severity":"error","filePath":"error.go","lineNumber":24,"sourceCode":"\n\t\"github.com/gofiber/schema\"\n)\n\n// Wrap and return this for unreachable code if panicking is undesirable (i.e., in a handler).\n// Unexported because users will hopefully never need to see it.\nvar errUnreachable = errors.New(\"fiber: unreachable code, please create an issue at github.com/gofiber/fiber\")\n\n// General errors\nvar (\n\tErrGracefulTimeout = errors.New(\"shutdown: graceful timeout has been reached, exiting\")\n\t// ErrNotRunning indicates that a Shutdown method was called when the server was not running.\n\tErrNotRunning = errors.New(\"shutdown: server is not running\")\n\t// ErrHandlerExited is returned by App.Test if a handler panics or calls runtime.Goexit().\n\tErrHandlerExited = errors.New(\"runtime.Goexit() called in handler or server panic\")\n\t// ErrNoViewEngineConfigured indicates that a helper requiring a view engine was invoked without one configured.\n\tErrNoViewEngineConfigured = errors.New(\"fiber: no view engine configured\")\n\t// ErrAutoCertWithCertFile indicates AutoCertManager cannot be used with CertFile/CertKeyFile.\n\tErrAutoCertWithCertFile = errors.New(\"tls: AutoCertManager cannot be combined with CertFile/CertKeyFile\")\n)\n\n// Fiber redirection errors\nvar (\n\tErrRedirectBackNoFallback = NewError(StatusInternalServerError, \"Referer not found, you have to enter fallback URL for redirection.\")\n)\n\n// Range errors\nvar (\n\t// ErrRangeMalformed is returned for a syntactically invalid Range header,\n\t// which RFC 9110 Section 14.2 allows a server to reject; it carries a\n\t// 400 Bad Request status so propagating it does not surface as a 500.\n\tErrRangeMalformed = NewError(StatusBadRequest, \"range: malformed range header string\")\n\t// ErrRangeUnsupported is returned for a Range header whose range unit is\n\t// not \"bytes\". RFC 9110 Section 14.2 requires an origin server to IGNORE\n\t// a Range header field with a range unit it does not understand, so\n\t// callers receiving this error should serve the full representation\n\t// instead of returning an error response. It still carries a","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/error.go#L6-L42","documentation":"ErrAutoCertWithCertFile (error.go:24) is returned by app.Listen (listen.go:210) when the ListenConfig supplies both an AutoCertManager (automatic Let's Encrypt certificate management) and explicit CertFile/CertKeyFile paths. These are mutually exclusive TLS sources; supplying both is contradictory, so Fiber rejects the call before attempting to build a tls.Config.","triggerScenarios":"Calling app.Listen(\":443\", fiber.ListenConfig{AutoCertManager: mgr, CertFile: \"cert.pem\", CertKeyFile: \"key.pem\"}). Also when config is loaded from a file/env and both TLS modes are populated.","commonSituations":"Migrating from static certificates to autocert (or vice versa) and forgetting to clear the old fields, or a templated config that defaults both. Environment overlays that set CERT_FILE while autocert is already enabled.","solutions":["Choose one TLS source: pass either AutoCertManager OR CertFile+CertKeyFile, never both.","In config loaders, explicitly zero out the unused TLS fields based on a single 'tls.mode' switch.","Add a startup assertion that fails fast when both are set, so the contradiction is reported with your own message."],"exampleFix":"// before\napp.Listen(\":443\", fiber.ListenConfig{\n    AutoCertManager: autocertMgr,\n    CertFile:        \"cert.pem\",\n    CertKeyFile:     \"key.pem\",\n})\n\n// after\napp.Listen(\":443\", fiber.ListenConfig{\n    AutoCertManager: autocertMgr,\n})","handlingStrategy":"validation","validationCode":"// Enforce a single TLS mode before listening.\nif cfg.AutoCertManager != nil {\n    cfg.CertFile = \"\"\n    cfg.CertKeyFile = \"\"\n}\nif cfg.AutoCertManager != nil && (cfg.CertFile != \"\" || cfg.CertKeyFile != \"\") {\n    return errors.New(\"cannot use AutoCertManager with CertFile/CertKeyFile\")\n}","typeGuard":null,"tryCatchPattern":"if err := app.Listen(\":443\", cfg); err != nil {\n    if errors.Is(err, fiber.ErrAutoCertWithCertFile) {\n        log.Fatal(\"choose either AutoCertManager OR CertFile/CertKeyFile, not both\")\n    }\n    log.Fatal(err)\n}","preventionTips":["Treat autocert and static certs as mutually exclusive in config schemas.","Zero the unused fields based on a single tls.mode switch when loading config.","Add a startup assertion to fail fast with a clear message."],"tags":["tls","config","security","https","fiber"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}