risingwavelabs/risingwave · error · anyhow::Error

RW_SSL_CERT and RW_SSL_KEY must be set together

Error message

RW_SSL_CERT and RW_SSL_KEY must be set together

What it means

TLS configuration in `PgLseConfig/SslConfig::new_default` reads `RW_SSL_CERT` and `RW_SSL_KEY` env vars. Setting exactly one of them is a misconfiguration, so it fails fast with an anyhow error at startup. Both must be present to enable TLS.

Source

Thrown at src/utils/pgwire/src/pg_protocol.rs:133

/// Configures TLS encryption for connections.
#[derive(Debug, Clone)]
pub struct TlsConfig {
    /// The path to the TLS certificate.
    pub cert: String,
    /// The path to the TLS key.
    pub key: String,
    /// Whether to enforce SSL connections (reject non-SSL clients).
    pub enforce_ssl: bool,
}

impl TlsConfig {
    pub fn new_default() -> anyhow::Result<Option<Self>> {
        let cert = std::env::var("RW_SSL_CERT").ok();
        let key = std::env::var("RW_SSL_KEY").ok();
        let enforce_ssl = env_var_is_true("RW_SSL_ENFORCE");

        if cert.is_some() ^ key.is_some() {
            return Err(anyhow::anyhow!(
                "RW_SSL_CERT and RW_SSL_KEY must be set together"
            ));
        }

        if enforce_ssl && cert.is_none() {
            return Err(anyhow::anyhow!(
                "RW_SSL_ENFORCE requires RW_SSL_CERT and RW_SSL_KEY to be set"
            ));
        }

        let (Some(cert), Some(key)) = (cert, key) else {
            return Ok(None);
        };

        tracing::info!(
            "RW_SSL_CERT={}, RW_SSL_KEY={}, RW_SSL_ENFORCE={}",
            cert,
            key,

View on GitHub (pinned to 6469eb736d)

Solutions

1. Set both `RW_SSL_CERT` and `RW_SSL_KEY` to valid file paths.
2. Unset the lone variable if TLS is not intended.
3. In Kubernetes, ensure the secret containing both cert and key is mounted and both env vars point at the mount.

Example fix

// before
RW_SSL_CERT=/certs/server.crt ./risingwave frontend
// after
RW_SSL_CERT=/certs/server.crt RW_SSL_KEY=/certs/server.key ./risingwave frontend

let cert = std::env::var("RW_SSL_CERT").ok();
let key = std::env::var("RW_SSL_KEY").ok();
if cert.is_some() ^ key.is_some() { panic!("set both RW_SSL_CERT and RW_SSL_KEY or neither"); }

match SslConfig::new_default() {
    Err(e) if e.to_string().contains("must be set together") => fix_env_and_restart(),
    other => other?,
}

When it happens

Trigger: Starting a RisingWave node (frontend/compute) with `RW_SSL_CERT` exported but `RW_SSL_KEY` missing, or vice versa.

Common situations: Deployments where the cert file is mounted but the key secret was not; updating config via k8s env where one var was renamed; copy-paste of only one var in shell profiles.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• RW_SSL_ENFORCE requires RW_SSL_CERT and RW_SSL_KEY to be set
• Failed to parse TOKIO_WORKER_THREADS
• should have meta client
• Root directory does not exist: {}
• env variable `RW_HUMMOCK_URL` not found. * start the cluste

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/5384b410c5420750. Report an issue: GitHub.