cannot require TLS client connections without TLS key and ce

Error message

cannot require TLS client connections without TLS key and cert

What it means

buildTLSConfig returns a nil config when no certificate/key pair was supplied. If TLS is nonetheless mandatory - --tls-required=true, or --tls-client-auth-policy set which implicitly upgrades TLSRequired from TLSNotRequired to TLSRequired - nsqd.New fails with this error rather than starting a server that would immediately reject or mis-handle TLS connections.

Source

Thrown at nsqd/nsqd.go:128

	if opts.MaxDeflateLevel < 1 || opts.MaxDeflateLevel > 9 {
		return nil, errors.New("--max-deflate-level must be [1,9]")
	}

	if opts.ID < 0 || opts.ID >= 1024 {
		return nil, errors.New("--node-id must be [0,1024)")
	}

	if opts.TLSClientAuthPolicy != "" && opts.TLSRequired == TLSNotRequired {
		opts.TLSRequired = TLSRequired
	}

	tlsConfig, err := buildTLSConfig(opts)
	if err != nil {
		return nil, fmt.Errorf("failed to build TLS config - %s", err)
	}
	if tlsConfig == nil && opts.TLSRequired != TLSNotRequired {
		return nil, errors.New("cannot require TLS client connections without TLS key and cert")
	}
	n.tlsConfig = tlsConfig

	clientTLSConfig, err := buildClientTLSConfig(opts)
	if err != nil {
		return nil, fmt.Errorf("failed to build client TLS config - %s", err)
	}
	n.clientTLSConfig = clientTLSConfig

	if opts.AuthHTTPRequestMethod != "post" && opts.AuthHTTPRequestMethod != "get" {
		return nil, errors.New("--auth-http-request-method must be post or get")
	}

	for _, v := range opts.E2EProcessingLatencyPercentiles {
		if v <= 0 || v > 1 {
			return nil, fmt.Errorf("invalid E2E processing latency percentile: %v", v)
		}
	}

View on GitHub (pinned to 85cf10c09c)

Solutions

Provide the pair: --tls-cert=/etc/nsq/cert.pem --tls-key=/etc/nsq/key.pem (files must be readable by the nsqd user).
Or drop the requirement: remove --tls-required and --tls-client-auth-policy if TLS is not actually needed.
Verify with openssl s_client -connect host:4150 -tls1 after restart to confirm the listener now speaks TLS.

Example fix

# before
nsqd --tls-required=true
# after
nsqd --tls-required=true --tls-cert=/etc/nsq/cert.pem --tls-key=/etc/nsq/key.pem

Defensive patterns

Strategy: validation

Validate before calling

needsTLS := opts.TLSRequired != nsqd.TLSNotRequired || opts.TLSClientAuthPolicy != ""
if needsTLS && (opts.TLSCert == "" || opts.TLSKey == "") {
	return errors.New("TLS required but cert/key not configured")
}
// also preflight the pair
if _, err := tls.LoadX509KeyPair(opts.TLSCert, opts.TLSKey); needsTLS && err != nil {
	return fmt.Errorf("bad TLS pair: %w", err)
}

Prevention

Deploy cert/key and the require flags as one atomic config unit; never flip --tls-required in a separate change.
Health-check the TLS port (openssl s_client) after every cert rotation.

When it happens

Trigger: Configuring --tls-required=true (or TLS_REQUIRED env / opts) without --tls-cert and --tls-key; setting --tls-client-auth-policy=require while forgetting the server certificate; enabling TLS in a config file whose cert/key paths section was dropped.

Common situations: Security hardening passes that flip the require flag before provisioning certs; cert rotation scripts that leave flags in place but files absent; container images that mount certs at a different path than the flags declare.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of nsqio/nsq@85cf10c09c (2026-08-16). Data as JSON: /api/errors/c90e6aabcd695b2f. Report an issue: GitHub.