Error: The protocol is https but attribute ssl_cert_key is n

Error message

Error: The protocol is https but attribute ssl_cert_key is not set

What it means

Thrown by the legacy validator in make/photon/prepare/utils/misc.py, which checks a ConfigParser-style harbor.cfg (pre-yaml configuration, still exercised by the migrator when processing old versions). When [configuration] ui_url_protocol = https but the ssl_cert_key option is absent, HTTPS cannot be configured and the validator aborts. This is the key-half of the certificate pair check (the ssl_cert branch sits just above it).

Source

Thrown at make/photon/prepare/utils/misc.py:31

    if mode > 0:
        os.chmod(path, mode)
    if uid > 0 and gid > 0:
        os.chown(path, uid, gid)


def validate(conf, **kwargs):
    # Protocol validate
    protocol = conf.get("configuration", "ui_url_protocol")
    if protocol == "https":
        if not conf.has_option("configuration", "ssl_cert"):
            raise Exception(
                "Error: The protocol is https but attribute ssl_cert is not set")
        cert_path = conf.get("configuration", "ssl_cert")
        if not os.path.isfile(cert_path):
            raise Exception(
                "Error: The path for certificate: %s is invalid" % cert_path)
        if not conf.has_option("configuration", "ssl_cert_key"):
            raise Exception(
                "Error: The protocol is https but attribute ssl_cert_key is not set")
        cert_key_path = conf.get("configuration", "ssl_cert_key")
        if not os.path.isfile(cert_key_path):
            raise Exception(
                "Error: The path for certificate key: %s is invalid" % cert_key_path)

    # Storage validate
    valid_storage_drivers = ["filesystem",
                             "azure", "gcs", "s3", "swift", "oss"]
    storage_provider_name = conf.get(
        "configuration", "registry_storage_provider_name").strip()
    if storage_provider_name not in valid_storage_drivers:
        raise Exception("Error: storage driver %s is not supported, only the following ones are supported: %s" % (
            storage_provider_name, ",".join(valid_storage_drivers)))

    storage_provider_config = conf.get(
        "configuration", "registry_storage_provider_config").strip()
    if storage_provider_name != "filesystem":

View on GitHub (pinned to 7b2fd08cc5)

Solutions

Add 'ssl_cert_key = /path/to/server.key' under [configuration] in harbor.cfg pointing at the private key on the host
Set the matching 'ssl_cert = /path/to/server.crt' as well
Or set 'ui_url_protocol = http' if https is not actually wanted (insecure)
Preferably migrate to harbor.yml (Harbor >= 1.8) and use https.certificate / https.private_key

Example fix

# harbor.cfg (before)
[configuration]
ui_url_protocol = https
ssl_cert = /data/cert/server.crt
# ssl_cert_key missing

# harbor.cfg (after)
[configuration]
ui_url_protocol = https
ssl_cert = /data/cert/server.crt
ssl_cert_key = /data/cert/server.key

Defensive patterns

Strategy: validation

Validate before calling

import configparser
conf = configparser.ConfigParser()
conf.read('harbor.cfg')
if conf.get('configuration', 'ui_url_protocol') == 'https':
    for opt in ('ssl_cert', 'ssl_cert_key'):
        if not conf.has_option('configuration', opt):
            raise SystemExit('harbor.cfg: %s is required when ui_url_protocol = https' % opt)

Prevention

ui_url_protocol = https requires both ssl_cert and ssl_cert_key in harbor.cfg
When hand-merging old configs, diff against the shipped template for missing keys
Move to harbor.yml on Harbor >= 1.8 to get clearer yaml validation

When it happens

Trigger: A harbor.cfg with 'ui_url_protocol = https' where the 'ssl_cert_key =' line under [configuration] is missing or commented out. conf.has_option('configuration', 'ssl_cert_key') returns False and the raise fires.

Common situations: Upgrading old Harbor releases (<1.8) whose harbor.cfg switched to https without supplying both cert options; hand-merging harbor.cfg during migrations where lines got dropped.

Related errors

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/2ab1bd2fc8bd8364. Report an issue: GitHub.