vllm-project/vllm · error

--ssl-cert-reqs must be 0 (none), 1 (optional), or 2 (requir

Error message

--ssl-cert-reqs must be 0 (none), 1 (optional), or 2 (required), got {}

What it means

Thrown by TlsConfig::validate() when --ssl-cert-reqs is outside the accepted set {0, 1, 2}, mirroring Python ssl.CERT_NONE/CERT_OPTIONAL/CERT_REQUIRED. The check is a matches!(self.cert_reqs, 0..=2) guard at startup; the offending numeric value is printed in the message.

Source

Thrown at rust/src/server/src/config.rs:142

    pub cert_reqs: i32,
    /// OpenSSL cipher string for TLS 1.2 and below, mirroring Python's
    /// `ssl.set_ciphers`. `None` keeps the forward-secret AEAD default.
    pub ciphers: Option<String>,
}

impl TlsConfig {
    /// Structurally validate the TLS arguments; the cert/key material is parsed
    /// later, when the OpenSSL context is built.
    pub fn validate(&self) -> Result<()> {
        if self.cert_file.is_none() {
            bail!(
                "--ssl-certfile is required to enable TLS; \
                 --ssl-keyfile/--ssl-ca-certs/--ssl-cert-reqs/--ssl-ciphers \
                 cannot be used without it"
            );
        }
        if !matches!(self.cert_reqs, 0..=2) {
            bail!(
                "--ssl-cert-reqs must be 0 (none), 1 (optional), or 2 (required), got {}",
                self.cert_reqs
            );
        }
        if self.cert_reqs != 0 && self.ca_certs.is_none() {
            bail!(
                "--ssl-ca-certs is required when --ssl-cert-reqs is {} \
                 (client certificate verification)",
                self.cert_reqs
            );
        }
        Ok(())
    }
}

/// Normalized runtime configuration for the minimal OpenAI-compatible server.
#[derive(Educe, Clone, PartialEq, Eq, Serialize)]
#[educe(Debug)]

View on GitHub (pinned to c794754062)

Solutions

1. Use 0 for no client cert verification, 1 for optional, 2 for required.
2. Cross-check against Python: 0=ssl.CERT_NONE, 1=ssl.CERT_OPTIONAL, 2=ssl.CERT_REQUIRED.
3. If you set --ssl-cert-reqs to 1 or 2, also set --ssl-ca-certs to avoid the follow-on validation error.

Example fix

# before
--ssl-certfile server.pem --ssl-cert-reqs 4

# after
--ssl-certfile server.pem --ssl-cert-reqs 2 --ssl-ca-certs ca.pem

fn valid_cert_reqs(v: i32) -> bool {
    (0..=2).contains(&v)
}

fn is_valid_cert_reqs(cert_reqs: i32) -> bool {
    matches!(cert_reqs, 0..=2)
}

When it happens

Trigger: Passing --ssl-cert-reqs 3, a negative value, or a non-numeric value that a wrapper coerced to something out of range. Note that even cert_reqs=0 still requires --ssl-certfile to be set (that check runs first), so this error specifically means a cert file was provided but the requirement level is invalid.

Common situations: Copying Python code that uses ssl.CERT_REQUIRED (numeric 2) but mis-transcribing it (e.g. 4 after editing); using an enum-like constant from another library whose values do not match 0/1/2; configuration management templating the wrong default.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• --ssl-certfile is required to enable TLS; --ssl-keyfile/--ss
• --ssl-ca-certs is required when --ssl-cert-reqs is {} (clien
• invalid --allowed-methods value {method:?}: {e}
• invalid --allowed-headers value {header:?}: {e}
• max_logprobs must be non-negative or -1, got {}

AI-assisted analysis of vllm-project/vllm@c794754062 (2026-08-14). Data as JSON: /api/errors/714ee09c339d3a88. Report an issue: GitHub.