serverConfig.SecOpts must contain both Key and Certificate w

Error message

serverConfig.SecOpts must contain both Key and Certificate when UseTLS is true

What it means

Returned by NewGRPCServerFromListener when UseTLS is true but the SecureOptions carry only one of Key/Certificate. A TLS server needs the full keypair; the half-configured security options are rejected during server construction.

Source

Thrown at internal/pkg/comm/server.go:123

				// require TLS client auth
				grpcServer.tls.config.ClientAuth = tls.RequireAndVerifyClientCert
				// if we have client root CAs, create a certPool
				if len(secureConfig.ClientRootCAs) > 0 {
					grpcServer.tls.config.ClientCAs = x509.NewCertPool()
					for _, clientRootCA := range secureConfig.ClientRootCAs {
						err = grpcServer.appendClientRootCA(clientRootCA)
						if err != nil {
							return nil, err
						}
					}
				}
			}

			// create credentials and add to server options
			creds := NewServerTransportCredentials(grpcServer.tls, serverConfig.Logger)
			serverOpts = append(serverOpts, grpc.Creds(creds))
		} else {
			return nil, errors.New("serverConfig.SecOpts must contain both Key and Certificate when UseTLS is true")
		}
	}

	// set max send and recv msg sizes
	maxSendMsgSize := DefaultMaxSendMsgSize
	if serverConfig.MaxSendMsgSize != 0 {
		maxSendMsgSize = serverConfig.MaxSendMsgSize
	}
	maxRecvMsgSize := DefaultMaxRecvMsgSize
	if serverConfig.MaxRecvMsgSize != 0 {
		maxRecvMsgSize = serverConfig.MaxRecvMsgSize
	}
	serverOpts = append(serverOpts, grpc.MaxSendMsgSize(maxSendMsgSize))
	serverOpts = append(serverOpts, grpc.MaxRecvMsgSize(maxRecvMsgSize))
	// set the keepalive options
	serverOpts = append(serverOpts, serverConfig.KaOpts.ServerKeepaliveOptions()...)
	// set connection timeout
	if serverConfig.ConnectionTimeout <= 0 {

View on GitHub (pinned to 2736b63f8f)

Solutions

Set both peer.tls.certFile and peer.tls.keyFile in SecOpts
Or disable TLS if not needed

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at internal/pkg/comm/server.go:123 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/ab661deda4f70952. Report an issue: GitHub.