sgl-project/sglang · error · ValueError

SSL key file not found: '{cfg.ssl_keyfile}'. Please check th

Error message

SSL key file not found: '{cfg.ssl_keyfile}'. Please check the --ssl-keyfile path.

What it means

ServerArgs validation error raised when the file given by --ssl-keyfile does not exist on disk. SGLang checks early (before model loading) so a bad TLS path fails in seconds instead of after a multi-minute model load.

Source

Thrown at python/sglang/srt/server_args.py:4328

            raise ValueError(
                "--ssl-keyfile requires --ssl-certfile to be specified as well."
            )
        if cfg.ssl_certfile and not cfg.ssl_keyfile:
            raise ValueError(
                "--ssl-certfile requires --ssl-keyfile to be specified as well."
            )
        if not cfg.ssl_certfile and not cfg.ssl_keyfile:
            if cfg.ssl_ca_certs:
                raise ValueError(
                    "--ssl-ca-certs has no effect without --ssl-certfile and --ssl-keyfile."
                )
            if cfg.ssl_keyfile_password:
                raise ValueError(
                    "--ssl-keyfile-password has no effect without --ssl-certfile and --ssl-keyfile."
                )
        # Validate files exist early to avoid late failures after model loading.
        if cfg.ssl_keyfile and not os.path.isfile(cfg.ssl_keyfile):
            raise ValueError(
                f"SSL key file not found: '{cfg.ssl_keyfile}'. "
                f"Please check the --ssl-keyfile path."
            )
        if cfg.ssl_certfile and not os.path.isfile(cfg.ssl_certfile):
            raise ValueError(
                f"SSL certificate file not found: '{cfg.ssl_certfile}'. "
                f"Please check the --ssl-certfile path."
            )
        if cfg.ssl_ca_certs and not os.path.isfile(cfg.ssl_ca_certs):
            raise ValueError(
                f"SSL CA certificates file not found: '{cfg.ssl_ca_certs}'. "
                f"Please check the --ssl-ca-certs path."
            )
        if cfg.enable_ssl_refresh and not (cfg.ssl_certfile and cfg.ssl_keyfile):
            raise ValueError(
                "--enable-ssl-refresh requires --ssl-certfile and --ssl-keyfile "
                "to be specified."
            )

View on GitHub (pinned to 0132848349)

Solutions

Fix the path: use an absolute path to the existing key file
If containerized, verify the secret/volume is actually mounted at that path (kubectl exec ls)
If relative, check the process CWD or switch to absolute paths

Example fix

# before
--ssl-keyfile server.key  # file lives in /etc/sglang/tls/
# after
--ssl-keyfile /etc/sglang/tls/server.key

Defensive patterns

Strategy: validation

Validate before calling

import os

def validate_ssl_paths(key: str | None, cert: str | None, ca: str | None) -> None:
    if key and not os.path.isfile(key):
        raise FileNotFoundError(key)
    if cert and not os.path.isfile(cert):
        raise FileNotFoundError(cert)
    if ca and not os.path.isfile(ca):
        raise FileNotFoundError(ca)

Prevention

Use absolute paths for all TLS file flags
In containers, verify secret mounts before launch (entrypoint ls check)
Run os.path.isfile checks in a preflight script or container entrypoint

When it happens

Trigger: Launching with --ssl-keyfile pointing to a nonexistent path: wrong directory, typo, file not mounted into the container, or relative path resolved from a different CWD.

Common situations: Docker/Kubernetes deployments where the secret mount path differs from the local one; running from a different working directory with relative paths; cert rotation scripts that moved/renamed files.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of sgl-project/sglang@0132848349 (2026-08-28). Data as JSON: /api/errors/a3cea9c2195334c4. Report an issue: GitHub.