ory/hydra · error

no tls configuration was found

Error message

no tls configuration was found

What it means

ErrNoCertificatesConfigured is returned when no TLS certificate material was provided at all — the code path checks that cert/key PEM base64 values and cert/key file paths are all empty. It signals that HTTPS cannot be configured because there is nothing to load, and is wrapped with a stack trace by the tlsx helpers.

Source

Thrown at oryx/tlsx/cert.go:36

	"encoding/pem"
	"fmt"
	"io"
	"math/big"
	"os"
	"path/filepath"
	"slices"
	"sync/atomic"
	"testing"
	"time"

	"github.com/pkg/errors"
	"github.com/stretchr/testify/require"

	"github.com/ory/x/watcherx"
)

// ErrNoCertificatesConfigured is returned when no TLS configuration was found.
var ErrNoCertificatesConfigured = errors.New("no tls configuration was found")

// ErrInvalidCertificateConfiguration is returned when an invalid TLS configuration was found.
var ErrInvalidCertificateConfiguration = errors.New("tls configuration is invalid")

// HTTPSCertificate returns loads a HTTP over TLS Certificate by looking at environment variables.
func HTTPSCertificate() ([]tls.Certificate, error) {
	prefix := "HTTPS_TLS"
	return Certificate(
		os.Getenv(prefix+"_CERT"), os.Getenv(prefix+"_KEY"),
		os.Getenv(prefix+"_CERT_PATH"), os.Getenv(prefix+"_KEY_PATH"),
	)
}

// HTTPSCertificateHelpMessage returns a help message for configuring HTTP over TLS Certificates.
func HTTPSCertificateHelpMessage() string {
	return CertificateHelpMessage("HTTPS_TLS")
}

View on GitHub (pinned to 4174065ffb)

Solutions

1. Provide both the certificate and key — either as base64 PEM values or as file paths
2. Set the expected environment variables (e.g. HTTPS_TLS_CERT and HTTPS_TLS_KEY) for the env-based helper
3. If TLS is intentionally disabled, guard the certificate-loading call instead of invoking it unconditionally
4. For file-based loading, ensure BOTH cert and key paths are non-empty before calling

Example fix

// before
// no TLS env vars set
certs, err := HTTPSCertificate() // ErrNoCertificatesConfigured
// after
export HTTPS_TLS_CERT=$(base64 -w0 server.crt)
export HTTPS_TLS_KEY=$(base64 -w0 server.key)
certs, err := HTTPSCertificate()

func tlsConfigured(certPEM, keyPEM, certPath, keyPath string) bool {
	return (certPEM != "" && keyPEM != "") || (certPath != "" && keyPath != "")
}

func isNoCertsConfigured(err error) bool {
	return errors.Is(err, tlsx.ErrNoCertificatesConfigured)
}

certs, err := tlsx.HTTPSCertificate()
if err != nil {
	if errors.Is(err, tlsx.ErrNoCertificatesConfigured) {
		log.Println("TLS disabled: no certificates configured")
		return servePlainHTTP()
	}
	return err
}

When it happens

Trigger: Calling Certificate() (or GetCertificate) with all of certPEMBase64, keyPEMBase64, certPath, keyPath empty; calling HTTPSCertificate()/other env-based helpers with no HTTPS_TLS_CERT/HTTPS_TLS_KEY environment variables set; calling LoadCertificate with only one of certPath/keyPath empty (cert.go:145).

Common situations: Forgetting to mount or set TLS secret/env variables in Kubernetes or Docker deployments; running locally without TLS intending plain HTTP but code still requests a certificate; only supplying the certificate without its private key (or vice versa) in the path-based variant.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• tls configuration is invalid
• cookiex: purpose must be non-empty and must not contain a pi
• cookiex: at least one secret is required
• file loader disabled
• http(s) loader disabled

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/068a2400c840b348. Report an issue: GitHub.