sgl-project/sglang · error · ValueError

--enable-ssl-refresh is not supported with --enable-http2. G

Error message

--enable-ssl-refresh is not supported with --enable-http2. Granian does not support SSL certificate hot-reloading. Use Uvicorn (the default) or handle certificate rotation externally.

What it means

SSL certificate hot-reloading is implemented for the default Uvicorn server and is not supported by granian (the HTTP/2 backend). SGLang rejects the combination --enable-ssl-refresh with --enable-http2 at startup.

Source

Thrown at python/sglang/srt/server_args.py:4364

            )

        if cfg.enable_http2:
            if not 0 < cfg.http2_max_concurrent_streams < 2**32:
                raise ValueError(
                    "--http2-max-concurrent-streams must be between 1 and "
                    "4294967295."
                )

            try:
                import granian  # noqa: F401
            except ImportError:
                raise ValueError(
                    "--enable-http2 requires the 'granian' package. "
                    'Install it with: pip install "sglang[http2]"'
                )

            if cfg.enable_ssl_refresh:
                raise ValueError(
                    "--enable-ssl-refresh is not supported with --enable-http2. "
                    "Granian does not support SSL certificate hot-reloading. "
                    "Use Uvicorn (the default) or handle certificate rotation externally."
                )

    def _handle_multimodal(self):
        """Validate mm_process_config structure before model loading."""
        cfg = resolving_view(self)
        if (
            cfg.mm_preprocess_cache_size_mb is not None
            and cfg.mm_preprocess_cache_size_mb < 0
        ):
            raise ValueError("mm_preprocess_cache_size_mb must be non-negative")
        if cfg.mm_process_config is not None:
            if not isinstance(cfg.mm_process_config, dict):
                raise TypeError(
                    f"mm_process_config must be a dict, "
                    f"but got {type(cfg.mm_process_config)}"

View on GitHub (pinned to 0132848349)

Solutions

1. Remove --enable-ssl-refresh when using --enable-http2, and rotate certificates externally (e.g. restart, or a fronting load balancer terminating TLS)
2. Or keep --enable-ssl-refresh and drop --enable-http2 to stay on Uvicorn
3. Or terminate TLS at an ingress/nginx that supports hot-reload and proxy plain HTTP to sglang

Example fix

# before
--enable-http2 --enable-ssl-refresh --ssl-certfile c.pem --ssl-keyfile k.pem
# after
--enable-http2 --ssl-certfile c.pem --ssl-keyfile k.pem  # rotate externally

if args.enable_http2 and args.enable_ssl_refresh:
    raise SystemExit('ssl-refresh is incompatible with http2; rotate certs externally')

When it happens

Trigger: Passing both --enable-http2 and --enable-ssl-refresh on the command line or via env-derived args.

Common situations: Migrating an existing TLS deployment to HTTP/2 while keeping the rotation flags; templated launch scripts that always include refresh flags.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• --enable-ssl-refresh requires --ssl-certfile and --ssl-keyfi
• --dcp-replicate-q-proj only applies to the a2a/fi_a2a DCP co
• --ssl-keyfile requires --ssl-certfile to be specified as wel
• --ssl-certfile requires --ssl-keyfile to be specified as wel
• --ssl-ca-certs has no effect without --ssl-certfile and --ss

AI-assisted analysis of sgl-project/sglang@0132848349 (2026-08-28). Data as JSON: /api/errors/8607a73e14edf61f. Report an issue: GitHub.