phacility/phabricator · error · PhutilArgumentUsageException

A specified server (at index "%s", on port "%s") specifies a

Error message

A specified server (at index "%s", on port "%s") specifies a value for "%s", but no value for "%s" or "%s". Servers should only provide an SSL chain if they also provide an SSL key and SSL certificate.

What it means

Thrown when an Aphlict server entry sets 'ssl.chain' (the certificate chain file) but supplies neither 'ssl.key' nor 'ssl.cert'. A chain is only meaningful together with a key and certificate, so this combination is rejected.

Source

Thrown at src/applications/aphlict/management/PhabricatorAphlictManagementWorkflow.php:154

      }

      $ssl_key = idx($server, 'ssl.key');
      $ssl_cert = idx($server, 'ssl.cert');
      if (($ssl_key && !$ssl_cert) || ($ssl_cert && !$ssl_key)) {
        throw new PhutilArgumentUsageException(
          pht(
            'A specified server (at index "%s", on port "%s") specifies '.
            'only one of "%s" and "%s". Each server must specify neither '.
            '(to disable SSL) or specify both (to enable it).',
            $index,
            $port,
            'ssl.key',
            'ssl.cert'));
      }

      $ssl_chain = idx($server, 'ssl.chain');
      if ($ssl_chain && (!$ssl_key && !$ssl_cert)) {
        throw new PhutilArgumentUsageException(
          pht(
            'A specified server (at index "%s", on port "%s") specifies '.
            'a value for "%s", but no value for "%s" or "%s". Servers '.
            'should only provide an SSL chain if they also provide an SSL '.
            'key and SSL certificate.',
            $index,
            $port,
            'ssl.chain',
            'ssl.key',
            'ssl.cert'));
      }
    }

    if (!$servers) {
      throw new PhutilArgumentUsageException(
        pht(
          'Configuration file does not specify any servers. This service '.
          'will not be able to interact with the outside world if it does '.

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Add both "ssl.key" and "ssl.cert" alongside "ssl.chain" to fully enable SSL on that server
2. Or remove "ssl.chain" if this listener is meant to stay plaintext

Example fix

// before
{"type": "admin", "port": 22281, "ssl.chain": "/etc/ssl/chain.crt"}
// after
{"type": "admin", "port": 22281,
 "ssl.key": "/etc/ssl/aphlict.key",
 "ssl.cert": "/etc/ssl/aphlict.crt",
 "ssl.chain": "/etc/ssl/chain.crt"}

$chain = idx($server, 'ssl.chain');
if ($chain && (!idx($server, 'ssl.key') && !idx($server, 'ssl.cert'))) {
  throw new InvalidArgumentException('ssl.chain requires ssl.key and ssl.cert');
}

When it happens

Trigger: A server entry contains "ssl.chain": "/etc/ssl/ca-bundle.crt" while ssl.key and ssl.cert are absent or null — e.g. someone added the chain first intending to add the rest later, or a template sets chain unconditionally.

Common situations: Ansible/Puppet templates that always emit ssl.chain but conditionally omit key/cert for non-TLS hosts; partial migration to HTTPS.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• A specified server (at index "%s", on port "%s") specifies o
• Configuration file is not properly formatted JSON. %s
• Configuration file has improper configuration keys at top le
• Two servers (at indexes "%s" and "%s") both bind to the same
• A specified server (at index "%s", on port "%s") has an inva

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/1875805e48cf3705. Report an issue: GitHub.