private networking (swarm.key / LIBP2P_FORCE_PNET) does not

Error message

private networking (swarm.key / LIBP2P_FORCE_PNET) does not work with AutoTLS.Enabled=true, update config to remove this message

What it means

Kubo's daemon refuses to start (or disables AutoTLS with a logged error) when private networking via swarm.key or LIBP2P_FORCE_PNET is combined with AutoTLS. AutoTLS obtains certificates from a public CA (libp2p.direct), which would leak the private network's peer identity via crt.sh, so the combination is forbidden.

Source

Thrown at cmd/ipfs/kubo/daemon.go:479

		}
	}

	if isPrivateNetwork {
		// Private setups can't leverage peers returned by default IPNIs (Routing.Type=auto)
		// To avoid breaking existing setups, switch them to DHT-only.
		if routingOption == routingOptionAutoKwd {
			log.Error("Private networking (swarm.key / LIBP2P_FORCE_PNET) does not work with public HTTP IPNIs enabled by Routing.Type=auto. Kubo will use Routing.Type=dht instead. Update config to remove this message.")
			routingOption = routingOptionDHTKwd
		}

		// Private setups should not use public AutoTLS infrastructure
		// as it will leak their existence and PeerID identity to CA
		// and they will show up at https://crt.sh/?q=libp2p.direct
		enableAutoTLS := cfg.AutoTLS.Enabled.WithDefault(config.DefaultAutoTLSEnabled)
		if enableAutoTLS {
			if cfg.AutoTLS.Enabled != config.Default {
				// hard fail if someone tries to explicitly enable both
				return errors.New("private networking (swarm.key / LIBP2P_FORCE_PNET) does not work with AutoTLS.Enabled=true, update config to remove this message")
			} else {
				// print error and disable autotls if user runs on default settings
				log.Error("private networking (swarm.key / LIBP2P_FORCE_PNET) is not compatible with AutoTLS. Set AutoTLS.Enabled=false in config to remove this message.")
				cfg.AutoTLS.Enabled = config.False
			}
		}
	}

	// Use config for routing construction

	switch routingOption {
	case routingOptionSupernodeKwd:
		return errors.New("supernode routing was never fully implemented and has been removed")
	case routingOptionDefaultKwd, routingOptionAutoKwd:
		ncfg.Routing = libp2p.ConstructDefaultRouting(cfg, libp2p.DHTOption)
	case routingOptionAutoClientKwd:
		ncfg.Routing = libp2p.ConstructDefaultRouting(cfg, libp2p.DHTClientOption)
	case routingOptionDHTClientKwd:

View on GitHub (pinned to 329838acdf)

Solutions

Set AutoTLS.Enabled=false in the kubo config, or remove the explicit AutoTLS.Enabled entry so it stays at Default
Remove the swarm.key / unset LIBP2P_FORCE_PNET if private networking is not actually required
Restart the daemon; the hard error only fires when AutoTLS.Enabled is explicitly true

Example fix

// before (config.json)
"AutoTLS": { "Enabled": true }
// after
"AutoTLS": { "Enabled": false }

Defensive patterns

Strategy: validation

Validate before calling

// before starting the daemon
cfg, _ := ipfsConfigShow()
if cfg.AutoTLS.Enabled == true && (fileExists(cfg.Swarm.Key) || os.Getenv("LIBP2P_FORCE_PNET") != "") {
    // fix: set AutoTLS.Enabled=false or remove pnet
    fmt.Println("private networking is incompatible with AutoTLS; disable AutoTLS.Enabled")
}

Prevention

Do not set AutoTLS.Enabled explicitly unless you use the public network
In pnet deployments, template configs with AutoTLS.Enabled=false
Never combine LIBP2P_FORCE_PNET with public-facing TLS tooling

When it happens

Trigger: Running `ipfs daemon` when: (1) AutoTLS.Enabled=true is explicitly set in config while a swarm.key exists or LIBP2P_FORCE_PNET is set -> hard error; (2) AutoTLS is left at default while private networking is active -> logged error, AutoTLS forced off, daemon continues.

Common situations: Clusters using private networks (swarm.key) that upgraded and inherited an explicit AutoTLS.Enabled=true from config tooling; CI setups with LIBP2P_FORCE_PNET=1 and copied configs enabling AutoTLS.

Related errors

AI-assisted analysis of ipfs/kubo@329838acdf (2026-09-03). Data as JSON: /api/errors/799dcc0796b5a8b6. Report an issue: GitHub.