phacility/phabricator · error · ConduitException

ERR-NO-CERTIFICATE

ERR-NO-CERTIFICATE

Error message

ERR-NO-CERTIFICATE

What it means

conduit.connect only proceeds with the certificate path when BOTH authToken and authSignature are present. If either value is missing the else branch throws 'ERR-NO-CERTIFICATE' before any verification happens, i.e. the client never supplied the credentials to attempt the handshake.

Source

Thrown at src/applications/conduit/method/ConduitConnectConduitAPIMethod.php:145

              'correctly.',
              phutil_format_relative_time($threshold),
              $token,
              date('r', $token),
              $now,
              date('r', $now),
              ($token - $now),
              $threshold));
      }
      $valid = sha1($token.$user->getConduitCertificate());
      if (!phutil_hashes_are_identical($valid, $signature)) {
        throw new ConduitException('ERR-INVALID-CERTIFICATE');
      }
      $session_key = id(new PhabricatorAuthSessionEngine())->establishSession(
        PhabricatorAuthSession::TYPE_CONDUIT,
        $user->getPHID(),
        $partial = false);
    } else {
      throw new ConduitException('ERR-NO-CERTIFICATE');
    }

    return array(
      'connectionID'  => mt_rand(),
      'sessionKey'    => $session_key,
      'userPHID'      => $user->getPHID(),
    );
  }

}

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Perform the full old-style handshake: generate a token, call conduit.getcertificate, then send both authToken (unix timestamp) and authSignature (sha1(token . certificate)) with conduit.connect.
2. Check the parameter names are exactly authToken and authSignature, and that both survive your encoding.
3. Better: abandon the legacy path and authenticate with an API token via arc install-certificate.

// Client-side precondition before conduit.connect.
if (!strlen($token) || !strlen($signature)) {
  throw new Exception('authToken and authSignature are both required.');
}

When it happens

Trigger: Calling conduit.connect with only the 'user' parameter; a client that skips the conduit.getcertificate step and sends no token/signature; a parameter typo like 'authtoken' that Phabricator does not recognize.

Common situations: Hand-written clients testing the endpoint before implementing the full handshake; parameters dropped by form-encoding bugs (nested JSON not encoded as required).

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• ERR-INVALID-CERTIFICATE
• ERR-INVALID-USER
• ERR-RATE-LIMIT
• ERR-BAD-TOKEN
• Certificate token points to an invalid user!

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/0384353a5b47d1d6. Report an issue: GitHub.