sigoden/dufs · error · anyhow::Error

No tls-cert set

Error message

No tls-cert set

What it means

The mirror case of the tls-key check: Args::parse in src/args.rs bails with 'No tls-cert set' when --tls-key is provided without --tls-cert. A private key without a certificate cannot establish a TLS identity, so the parser rejects the combination at startup.

Solutions

1. Add --tls-cert pointing to the PEM certificate (or full chain) file
2. If you only wanted the key, you also need the cert — obtain/generate one (e.g. mkcert, Let's Encrypt)
3. Remove --tls-key if HTTPS was not intended

Example fix

# before
dufs ./assets --tls-key key.pem
# after
dufs ./assets --tls-cert cert.pem --tls-key key.pem

# shell pre-check
if [ -n "$TLS_KEY" ] && [ -z "$TLS_CERT" ]; then echo "--tls-cert is required with --tls-key"; exit 1; fi

When it happens

Trigger: Running dufs with --tls-key <path> but omitting --tls-cert <path>; the (None, Some(_)) arm of the TLS match bails.

Common situations: Script templating only substituted the key path; user confused --tls-cert with a cert directory flag and thought it was optional; partial migration from an HTTP setup.

Understand the failure class

Background: "--flag is required" and "must specify" CLI errors: how missing-required-flag validation works and how to fix it — this error's family across 20 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• No tls-key set
• Path ` ` doesn't contains index.html
• Invalid auth, no duplicate anonymous rules
• Invalid auth
• Path ` ` doesn't exist

AI-assisted analysis of sigoden/dufs@fe7fd564f8 (2026-09-09). Data as JSON: /api/errors/f024b52c167f3c40. Report an issue: GitHub.

Appendix: source

Thrown at src/args.rs:446

        if let Some(compress) = matches.get_one::<Compress>("compress") {
            args.compress = *compress;
        }

        #[cfg(feature = "tls")]
        {
            if let Some(tls_cert) = matches.get_one::<PathBuf>("tls-cert") {
                args.tls_cert = Some(tls_cert.clone())
            }

            if let Some(tls_key) = matches.get_one::<PathBuf>("tls-key") {
                args.tls_key = Some(tls_key.clone())
            }

            match (&args.tls_cert, &args.tls_key) {
                (Some(_), Some(_)) => {}
                (Some(_), _) => bail!("No tls-key set"),
                (_, Some(_)) => bail!("No tls-cert set"),
                (None, None) => {}
            }
        }
        #[cfg(not(feature = "tls"))]
        {
            args.tls_cert = None;
            args.tls_key = None;
        }

        Ok(args)
    }

    fn sanitize_path<P: AsRef<Path>>(path: P) -> Result<PathBuf> {
        let path = path.as_ref();
        if !path.exists() {
            bail!("Path `{}` doesn't exist", path.display());
        }

View on GitHub (pinned to fe7fd564f8)