txthinking/brook · error

--certkey must be with absolute path

Error message

--certkey must be with absolute path

What it means

When --certkey is provided to the brook server subcommand it must be an absolute path; relative paths are rejected during argument validation before the server starts. This mirrors the --cert requirement so TLS material is always locatable regardless of working directory.

Source

Thrown at cli/brook/main.go:865

					return nil
				}
				if c.String("domainaddress") == "" || c.String("password") == "" {
					return cli.ShowSubcommandHelp(c)
				}
				if c.String("blockDomainList") != "" && !strings.HasPrefix(c.String("blockDomainList"), "http://") && !strings.HasPrefix(c.String("blockDomainList"), "https://") && !filepath.IsAbs(c.String("blockDomainList")) {
					return errors.New("--blockDomainList must be with absolute path")
				}
				if c.String("blockCIDR4List") != "" && !strings.HasPrefix(c.String("blockCIDR4List"), "http://") && !strings.HasPrefix(c.String("blockCIDR4List"), "https://") && !filepath.IsAbs(c.String("blockCIDR4List")) {
					return errors.New("--blockCIDR4List must be with absolute path")
				}
				if c.String("blockCIDR6List") != "" && !strings.HasPrefix(c.String("blockCIDR6List"), "http://") && !strings.HasPrefix(c.String("blockCIDR6List"), "https://") && !filepath.IsAbs(c.String("blockCIDR6List")) {
					return errors.New("--blockCIDR6List must be with absolute path")
				}
				if c.String("cert") != "" && !filepath.IsAbs(c.String("cert")) {
					return errors.New("--cert must be with absolute path")
				}
				if c.String("certkey") != "" && !filepath.IsAbs(c.String("certkey")) {
					return errors.New("--certkey must be with absolute path")
				}
				if c.String("blockDomainList") != "" || c.String("blockCIDR4List") != "" || c.String("blockCIDR6List") != "" || len(c.StringSlice("blockGeoIP")) != 0 {
					p, err := block.NewBlock(c.String("blockDomainList"), c.String("blockCIDR4List"), c.String("blockCIDR6List"), c.StringSlice("blockGeoIP"), c.Int("updateListInterval"))
					if err != nil {
						return err
					}
					p.TouchBrook()
					if c.Int("updateListInterval") != 0 {
						g.Add(&runnergroup.Runner{
							Start: func() error {
								p.Update()
								return nil
							},
							Stop: func() error {
								p.Stop()
								return nil
							},
						})

View on GitHub (pinned to 5cd13ef3b1)

Solutions

1. Pass an absolute path: --certkey /etc/brook/server.key
2. Use realpath: --certkey "$(realpath server.key)"
3. Make both TLS flags absolute in the same config/systemd unit

Example fix

// before
brook server --cert /etc/brook/server.crt --certkey server.key
// after
brook server --cert /etc/brook/server.crt --certkey /etc/brook/server.key

if key := flagValue; key != "" && !filepath.IsAbs(key) {
    return fmt.Errorf("--certkey must be an absolute path, got %q", key)
}

func isAbsPath(p string) bool { return filepath.IsAbs(p) }

When it happens

Trigger: Running `brook server` with --certkey set to a relative path, e.g. --certkey server.key, even if --cert itself is absolute.

Common situations: Users fix --cert to an absolute path but forget --certkey in the same invocation; the key file usually sits next to the certificate in the launch directory.

Understand the failure class

Background: "unknown output mode", "invalid value for flag", "expects true/false": fixing invalid flag value errors in CLI tools — this error's family across 24 libraries.

Related errors

• --cert must be with absolute path
• socks5 server requires a clear IP for UDP, only port is not
• Looks like you want create socks5 from a socks5, you may wan
• --pid must be with absolute path
• --log must be with absolute path

AI-assisted analysis of txthinking/brook@5cd13ef3b1 (2026-09-06). Data as JSON: /api/errors/44f4ae8de0e8e03b. Report an issue: GitHub.