gofiber/fiber · error · ErrAutoCertWithCertFile

tls: AutoCertManager cannot be combined with CertFile/CertKe

Error message

tls: AutoCertManager cannot be combined with CertFile/CertKeyFile

What it means

ErrAutoCertWithCertFile (error.go:24) is returned by app.Listen (listen.go:210) when the ListenConfig supplies both an AutoCertManager (automatic Let's Encrypt certificate management) and explicit CertFile/CertKeyFile paths. These are mutually exclusive TLS sources; supplying both is contradictory, so Fiber rejects the call before attempting to build a tls.Config.

Source

Thrown at error.go:24

	"github.com/gofiber/schema"
)

// Wrap and return this for unreachable code if panicking is undesirable (i.e., in a handler).
// Unexported because users will hopefully never need to see it.
var errUnreachable = errors.New("fiber: unreachable code, please create an issue at github.com/gofiber/fiber")

// General errors
var (
	ErrGracefulTimeout = errors.New("shutdown: graceful timeout has been reached, exiting")
	// ErrNotRunning indicates that a Shutdown method was called when the server was not running.
	ErrNotRunning = errors.New("shutdown: server is not running")
	// ErrHandlerExited is returned by App.Test if a handler panics or calls runtime.Goexit().
	ErrHandlerExited = errors.New("runtime.Goexit() called in handler or server panic")
	// ErrNoViewEngineConfigured indicates that a helper requiring a view engine was invoked without one configured.
	ErrNoViewEngineConfigured = errors.New("fiber: no view engine configured")
	// ErrAutoCertWithCertFile indicates AutoCertManager cannot be used with CertFile/CertKeyFile.
	ErrAutoCertWithCertFile = errors.New("tls: AutoCertManager cannot be combined with CertFile/CertKeyFile")
)

// Fiber redirection errors
var (
	ErrRedirectBackNoFallback = NewError(StatusInternalServerError, "Referer not found, you have to enter fallback URL for redirection.")
)

// Range errors
var (
	// ErrRangeMalformed is returned for a syntactically invalid Range header,
	// which RFC 9110 Section 14.2 allows a server to reject; it carries a
	// 400 Bad Request status so propagating it does not surface as a 500.
	ErrRangeMalformed = NewError(StatusBadRequest, "range: malformed range header string")
	// ErrRangeUnsupported is returned for a Range header whose range unit is
	// not "bytes". RFC 9110 Section 14.2 requires an origin server to IGNORE
	// a Range header field with a range unit it does not understand, so
	// callers receiving this error should serve the full representation
	// instead of returning an error response. It still carries a

View on GitHub (pinned to 9a4c7e57fe)

Solutions

1. Choose one TLS source: pass either AutoCertManager OR CertFile+CertKeyFile, never both.
2. In config loaders, explicitly zero out the unused TLS fields based on a single 'tls.mode' switch.
3. Add a startup assertion that fails fast when both are set, so the contradiction is reported with your own message.

Example fix

// before
app.Listen(":443", fiber.ListenConfig{
    AutoCertManager: autocertMgr,
    CertFile:        "cert.pem",
    CertKeyFile:     "key.pem",
})

// after
app.Listen(":443", fiber.ListenConfig{
    AutoCertManager: autocertMgr,
})

// Enforce a single TLS mode before listening.
if cfg.AutoCertManager != nil {
    cfg.CertFile = ""
    cfg.CertKeyFile = ""
}
if cfg.AutoCertManager != nil && (cfg.CertFile != "" || cfg.CertKeyFile != "") {
    return errors.New("cannot use AutoCertManager with CertFile/CertKeyFile")
}

if err := app.Listen(":443", cfg); err != nil {
    if errors.Is(err, fiber.ErrAutoCertWithCertFile) {
        log.Fatal("choose either AutoCertManager OR CertFile/CertKeyFile, not both")
    }
    log.Fatal(err)
}

When it happens

Trigger: Calling app.Listen(":443", fiber.ListenConfig{AutoCertManager: mgr, CertFile: "cert.pem", CertKeyFile: "key.pem"}). Also when config is loaded from a file/env and both TLS modes are populated.

Common situations: Migrating from static certificates to autocert (or vice versa) and forgetting to clear the old fields, or a templated config that defaults both. Environment overlays that set CERT_FILE while autocert is already enabled.

Related errors

• proxy: HTTPS to HTTP redirect blocked
• unsupported TLS version, please use tls.VersionTLS12 or tls.
• min constraint requires an argument
• max constraint requires an argument
• range constraint requires two arguments

AI-assisted analysis of gofiber/fiber@9a4c7e57fe (2026-08-04). Data as JSON: /data/errors/1fda7c882c41f821.json. Report an issue: GitHub.