valyala/fasthttp · error

cert or key has not provided

Error message

cert or key has not provided

What it means

errNoCertOrKeyProvided is an unexported fasthttp server error returned when TLS is expected but neither a certificate nor a key has been supplied to the server. Fasthttp requires at least one cert/key pair (via Certificate or cert/key data) before it can serve TLS connections.

Source

Thrown at server.go:20

import (
	"bufio"
	"context"
	"crypto/tls"
	"errors"
	"fmt"
	"io"
	"log"
	"mime/multipart"
	"net"
	"os"
	"strings"
	"sync"
	"sync/atomic"
	"time"
)

var errNoCertOrKeyProvided = errors.New("cert or key has not provided")

// ErrAlreadyServing is deprecated.
//
// Deprecated: ErrAlreadyServing is never returned from Serve. See issue #633.
var ErrAlreadyServing = errors.New("fasthttp: server is already serving connections")

// ServeConn serves HTTP requests from the given connection
// using the given handler.
//
// ServeConn returns nil if all requests from the c are successfully served.
// It returns non-nil error otherwise.
//
// Connection c must immediately propagate all the data passed to Write()
// to the client. Otherwise requests' processing may hang.
//
// ServeConn closes c before returning.
func ServeConn(c net.Conn, handler RequestHandler) error {
	v := serverPool.Get()

View on GitHub (pinned to c96f600972)

Solutions

1. Set Server.CertFile and Server.KeyFile (or use fasthttp.AppendCert / TLSConfig with loaded certificates).
2. Verify the cert/key config values are actually loaded (env vars, config file) before Serve.
3. Ensure ListenAndServeTLS is used with valid cert/key arguments.

Example fix

// before
srv := &fasthttp.Server{Handler: h}
srv.ListenAndServeTLS(":443", "", "") // no cert/key
// after
srv := &fasthttp.Server{Handler: h}
srv.ListenAndServeTLS(":443", "/etc/ssl/cert.pem", "/etc/ssl/key.pem")

if cfg.TLSEnabled && (cfg.CertFile == "" || cfg.KeyFile == "") {
    return errors.New("tls enabled but cert or key path is empty")
}

When it happens

Trigger: Starting a Server on a TLS listener or with TLS configuration where both CertFile/KeyFile (or the in-memory certificate fields) are empty.

Common situations: Config files with TLS section present but empty paths; environment variables for cert paths not set; forgot to call AppendCert or set Certificate after enabling HTTPS.

Related errors

• fasthttp: hostclient can't follow redirects to a different p
• fasthttp: tls handshake timed out
• fasthttp: too many connections per ip
• fasthttp: cannot serve the connection because server.concurr
• cannot determine tls server name from addr %q: %w

AI-assisted analysis of valyala/fasthttp@c96f600972 (2026-08-31). Data as JSON: /api/errors/e2d6c2643bd5e1fa. Report an issue: GitHub.