risingwavelabs/risingwave · error · anyhow::Error

RW_SSL_ENFORCE requires RW_SSL_CERT and RW_SSL_KEY to be set

Error message

RW_SSL_ENFORCE requires RW_SSL_CERT and RW_SSL_KEY to be set

What it means

When `RW_SSL_ENFORCE=true`, `SslConfig::new_default` requires an actual certificate/key pair; enforcing SSL without `RW_SSL_CERT`/`RW_SSL_KEY` would make TLS impossible, so it aborts startup with this anyhow error.

Source

Thrown at src/utils/pgwire/src/pg_protocol.rs:139

    pub key: String,
    /// Whether to enforce SSL connections (reject non-SSL clients).
    pub enforce_ssl: bool,
}

impl TlsConfig {
    pub fn new_default() -> anyhow::Result<Option<Self>> {
        let cert = std::env::var("RW_SSL_CERT").ok();
        let key = std::env::var("RW_SSL_KEY").ok();
        let enforce_ssl = env_var_is_true("RW_SSL_ENFORCE");

        if cert.is_some() ^ key.is_some() {
            return Err(anyhow::anyhow!(
                "RW_SSL_CERT and RW_SSL_KEY must be set together"
            ));
        }

        if enforce_ssl && cert.is_none() {
            return Err(anyhow::anyhow!(
                "RW_SSL_ENFORCE requires RW_SSL_CERT and RW_SSL_KEY to be set"
            ));
        }

        let (Some(cert), Some(key)) = (cert, key) else {
            return Ok(None);
        };

        tracing::info!(
            "RW_SSL_CERT={}, RW_SSL_KEY={}, RW_SSL_ENFORCE={}",
            cert,
            key,
            enforce_ssl
        );
        Ok(Some(Self {
            cert,
            key,
            enforce_ssl,

View on GitHub (pinned to 6469eb736d)

Solutions

1. Set both `RW_SSL_CERT` and `RW_SSL_KEY` to valid PEM file paths.
2. Disable `RW_SSL_ENFORCE` if TLS is not required in this environment.
3. Provision a certificate (e.g. via cert-manager) before enabling enforcement.

Example fix

// before
RW_SSL_ENFORCE=true ./risingwave frontend
// after
RW_SSL_ENFORCE=true RW_SSL_CERT=/certs/server.crt RW_SSL_KEY=/certs/server.key ./risingwave frontend

let enforce = std::env::var("RW_SSL_ENFORCE").map(|v| v=="true"||v=="1").unwrap_or(false);
if enforce && (std::env::var("RW_SSL_CERT").is_err() || std::env::var("RW_SSL_KEY").is_err()) {
    panic!("RW_SSL_ENFORCE requires RW_SSL_CERT and RW_SSL_KEY");
}

match SslConfig::new_default() {
    Err(e) if e.to_string().contains("RW_SSL_ENFORCE requires") => provision_certs_and_restart(),
    other => other?,
}

When it happens

Trigger: Starting a node with `RW_SSL_ENFORCE=true` (or '1'/'on') but without both `RW_SSL_CERT` and `RW_SSL_KEY` set.

Common situations: Security-hardened deployments flipping the enforce flag without provisioning certificates; environments where certs are injected later than the enforce flag.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

• RW_SSL_CERT and RW_SSL_KEY must be set together
• Failed to parse TOKIO_WORKER_THREADS
• should have meta client
• Root directory does not exist: {}
• env variable `RW_HUMMOCK_URL` not found. * start the cluste

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/aac099be9b0c1120. Report an issue: GitHub.