sgl-project/sglang · error · ValueError

SSL certificate file not found: '{cfg.ssl_certfile}'. Please

Error message

SSL certificate file not found: '{cfg.ssl_certfile}'. Please check the --ssl-certfile path.

What it means

ServerArgs validation error raised when the file given by --ssl-certfile does not exist on disk. Like the key check, it runs during argument resolution so the server never gets to model loading with a broken TLS configuration.

Source

Thrown at python/sglang/srt/server_args.py:4333

                "--ssl-certfile requires --ssl-keyfile to be specified as well."
            )
        if not cfg.ssl_certfile and not cfg.ssl_keyfile:
            if cfg.ssl_ca_certs:
                raise ValueError(
                    "--ssl-ca-certs has no effect without --ssl-certfile and --ssl-keyfile."
                )
            if cfg.ssl_keyfile_password:
                raise ValueError(
                    "--ssl-keyfile-password has no effect without --ssl-certfile and --ssl-keyfile."
                )
        # Validate files exist early to avoid late failures after model loading.
        if cfg.ssl_keyfile and not os.path.isfile(cfg.ssl_keyfile):
            raise ValueError(
                f"SSL key file not found: '{cfg.ssl_keyfile}'. "
                f"Please check the --ssl-keyfile path."
            )
        if cfg.ssl_certfile and not os.path.isfile(cfg.ssl_certfile):
            raise ValueError(
                f"SSL certificate file not found: '{cfg.ssl_certfile}'. "
                f"Please check the --ssl-certfile path."
            )
        if cfg.ssl_ca_certs and not os.path.isfile(cfg.ssl_ca_certs):
            raise ValueError(
                f"SSL CA certificates file not found: '{cfg.ssl_ca_certs}'. "
                f"Please check the --ssl-ca-certs path."
            )
        if cfg.enable_ssl_refresh and not (cfg.ssl_certfile and cfg.ssl_keyfile):
            raise ValueError(
                "--enable-ssl-refresh requires --ssl-certfile and --ssl-keyfile "
                "to be specified."
            )

        if cfg.enable_http2:
            if not 0 < cfg.http2_max_concurrent_streams < 2**32:
                raise ValueError(
                    "--http2-max-concurrent-streams must be between 1 and "

View on GitHub (pinned to 0132848349)

Solutions

Fix the path: use an absolute path to the existing certificate file
Confirm the exact filename (ls the directory; check .crt vs .pem)
If containerized, verify the volume/secret is mounted at that path

Example fix

# before
--ssl-certfile /certs/server.pem
# after
--ssl-certfile /etc/sglang/tls/server.crt

Defensive patterns

Strategy: validation

Validate before calling

import os

def validate_ssl_paths(key: str | None, cert: str | None, ca: str | None) -> None:
    if key and not os.path.isfile(key):
        raise FileNotFoundError(key)
    if cert and not os.path.isfile(cert):
        raise FileNotFoundError(cert)
    if ca and not os.path.isfile(ca):
        raise FileNotFoundError(ca)

Prevention

Use absolute paths and verify filenames (.crt/.pem) with ls before launch
After cert rotation, confirm the new filename matches the configured flag
Preflight-check TLS mounts in container entrypoints

When it happens

Trigger: Launching with --ssl-certfile pointing to a nonexistent path: typo, wrong extension (.pem vs .crt), unmounted secret, or wrong directory.

Common situations: Cert filenames differing between staging and prod; cert-manager renewed under a new name; container mounts missing; copy-paste from a runbook with different layout.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of sgl-project/sglang@0132848349 (2026-08-28). Data as JSON: /api/errors/b6ccb7b143c7b6bb. Report an issue: GitHub.