phacility/phabricator · error · PhutilArgumentUsageException

A specified server (at index "%s", on port "%s") specifies o

Error message

A specified server (at index "%s", on port "%s") specifies only one of "%s" and "%s". Each server must specify neither (to disable SSL) or specify both (to enable it).

What it means

Thrown when an Aphlict server entry specifies exactly one of the SSL options 'ssl.key' and 'ssl.cert'. SSL for a listener requires both a private key and a certificate; specifying only one is treated as a configuration error rather than silently starting plaintext.

Source

Thrown at src/applications/aphlict/management/PhabricatorAphlictManagementWorkflow.php:141

          $has_admin = true;
          break;
        case 'client':
          $has_client = true;
          break;
        default:
          throw new PhutilArgumentUsageException(
            pht(
              'A specified server (at index "%s", on port "%s") has an '.
              'invalid type ("%s"). Valid types are: admin, client.',
              $index,
              $port,
              $type));
      }

      $ssl_key = idx($server, 'ssl.key');
      $ssl_cert = idx($server, 'ssl.cert');
      if (($ssl_key && !$ssl_cert) || ($ssl_cert && !$ssl_key)) {
        throw new PhutilArgumentUsageException(
          pht(
            'A specified server (at index "%s", on port "%s") specifies '.
            'only one of "%s" and "%s". Each server must specify neither '.
            '(to disable SSL) or specify both (to enable it).',
            $index,
            $port,
            'ssl.key',
            'ssl.cert'));
      }

      $ssl_chain = idx($server, 'ssl.chain');
      if ($ssl_chain && (!$ssl_key && !$ssl_cert)) {
        throw new PhutilArgumentUsageException(
          pht(
            'A specified server (at index "%s", on port "%s") specifies '.
            'a value for "%s", but no value for "%s" or "%s". Servers '.
            'should only provide an SSL chain if they also provide an SSL '.
            'key and SSL certificate.',

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Provide both "ssl.key" and "ssl.cert" on the server entry to enable SSL, or remove/null both to disable it
2. Verify both paths exist and are readable by the user that runs aphlict before restarting
3. If you only meant to terminate TLS at a proxy/load balancer, remove ssl.* keys entirely and keep plain listeners

Example fix

// before
{"type": "client", "port": 22280, "ssl.key": "/etc/ssl/aphlict.key"}
// after
{"type": "client", "port": 22280,
 "ssl.key": "/etc/ssl/aphlict.key",
 "ssl.cert": "/etc/ssl/aphlict.crt"}

$key = idx($server, 'ssl.key');
$cert = idx($server, 'ssl.cert');
if (($key && !$cert) || ($cert && !$key)) {
  throw new InvalidArgumentException('ssl.key and ssl.cert must be set together');
}

function has_paired_ssl_config(array $server) {
  $k = idx($server, 'ssl.key');
  $c = idx($server, 'ssl.cert');
  return ($k && $c) || (!$k && !$c);
}

When it happens

Trigger: A server entry has "ssl.key": "/path/key.pem" but no "ssl.cert" (or vice versa), including the case where one is set to an empty-but-truthy string.

Common situations: Admin enables TLS incrementally and forgets the second file; paths use null for one and a path for the other after templating; cert renewal script rewrites only ssl.cert.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• A specified server (at index "%s", on port "%s") specifies a
• Configuration file is not properly formatted JSON. %s
• Configuration file has improper configuration keys at top le
• Two servers (at indexes "%s" and "%s") both bind to the same
• A specified server (at index "%s", on port "%s") has an inva

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/9f8d62f3f03a6d4d. Report an issue: GitHub.