temporalio/temporal · error

host name cannot be empty string

Error message

host name cannot be empty string

What it means

validateGroupTLS iterates PerHostOverrides of the root TLS config and rejects any override whose host key is empty (or only whitespace). Host keys select per-host server TLS settings, so an empty name is ambiguous and invalid. Raised during validateRootTLS, i.e. during TLS config validation before any connection is made.

Source

Thrown at common/rpc/encryption/tls_factory.go:98

		return err
	}
	if err := validateGroupTLS(&cfg.Frontend); err != nil {
		return err
	}
	return validateWorkerTLS(&cfg.SystemWorker)
}

func validateGroupTLS(cfg *config.GroupTLS) error {
	if err := validateServerTLS(&cfg.Server); err != nil {
		return err
	}
	if err := validateClientTLS(&cfg.Client); err != nil {
		return err
	}
	for host, hostConfig := range cfg.PerHostOverrides {

		if strings.TrimSpace(host) == "" {
			return fmt.Errorf("host name cannot be empty string")
		}
		if err := validateServerTLS(&hostConfig); err != nil {
			return err
		}
	}
	return nil
}

func validateWorkerTLS(cfg *config.WorkerTLS) error {
	if cfg.CertFile != "" && cfg.CertData != "" {
		return fmt.Errorf("cannot specify CertFile and CertData at the same time")
	}
	if cfg.KeyFile != "" && cfg.KeyData != "" {
		return fmt.Errorf("cannot specify KeyFile and KeyData at the same time")
	}
	return validateClientTLS(&cfg.Client)
}

View on GitHub (pinned to bde624efd1)

Solutions

1. Find the PerHostOverrides entry with an empty/blank host key in your dynamic config and give it a valid host name or IP.
2. Remove the empty entry if it was accidental.
3. Check config templating/expansion output for unresolved placeholders.
4. Validate the config offline before applying it to the cluster.

Example fix

// before
"frontend": {"PerHostOverrides": {"": {"serverName": "x"}}}
// after
"frontend": {"PerHostOverrides": {"temporal.internal:7233": {"serverName": "x"}}}

for host := range cfg.PerHostOverrides {
    if strings.TrimSpace(host) == "" {
        return errors.New("PerHostOverrides contains an empty host key")
    }
}

if err := validateGroupTLS(&cfg.Frontend); err != nil {
    return fmt.Errorf("invalid frontend TLS config: %w", err)
}

When it happens

Trigger: Dynamic config front-end/client TLS blocks containing a PerHostOverrides entry with an empty string or whitespace-only key, e.g. "frontend": {"": {...}} produced by templating or YAML parsing quirks.

Common situations: Dynamic config templates leaving a host placeholder unfilled; YAML merging producing an empty key; copy-pasted override entry where the host name was accidentally deleted.

Related errors

• only one of certData or certFile properties should be specif
• only one of keyData or keyFile properties should be specifie
• cert or key is missing
• only one of caData or caFile properties should be specified
• invalid value for publicClient.forceTLSConfig: %q

AI-assisted analysis of temporalio/temporal@bde624efd1 (2026-09-01). Data as JSON: /api/errors/805a876fc0bb5cf9. Report an issue: GitHub.