xai-org/x-algorithm · error · anyhow::Error

{ENV_GRPC_MTLS_CLIENT_CA_PATH} must be set

Error message

{ENV_GRPC_MTLS_CLIENT_CA_PATH} must be set

What it means

Raised in from_env when mTLS is enabled and the server key/cert are set, but GRPC_MTLS_CLIENT_CA_PATH (the CA that validates client certificates) is unset or empty. Mutual TLS requires the client CA so the server can verify incoming client certs.

Source

Thrown at visibility-filtering/config.rs:115

        let server_key_path = std::env::var(ENV_GRPC_MTLS_SERVER_KEY_PATH)
            .ok()
            .filter(|v| !v.is_empty())
            .ok_or_else(|| anyhow::anyhow!("{ENV_GRPC_MTLS_SERVER_KEY_PATH} must be set"))?;

        let server_crt_path = std::env::var(ENV_GRPC_MTLS_SERVER_CRT_PATH)
            .ok()
            .filter(|v| !v.is_empty())
            .ok_or_else(|| anyhow::anyhow!("{ENV_GRPC_MTLS_SERVER_CRT_PATH} must be set"))?;

        let server_chain_path = std::env::var(ENV_GRPC_MTLS_SERVER_CHAIN_PATH)
            .ok()
            .filter(|v| !v.is_empty());

        let client_ca_path = std::env::var(ENV_GRPC_MTLS_CLIENT_CA_PATH)
            .ok()
            .filter(|v| !v.is_empty())
            .ok_or_else(|| anyhow::anyhow!("{ENV_GRPC_MTLS_CLIENT_CA_PATH} must be set"))?;

        Ok(Some(Self {
            server_key_path,
            server_crt_path,
            server_chain_path,
            client_ca_path,
        }))
    }

    pub fn server_tls_config(&self) -> anyhow::Result<tonic::transport::ServerTlsConfig> {
        let mut cert_pem = std::fs::read(&self.server_crt_path)?;
        let key_pem = std::fs::read(&self.server_key_path)?;
        let client_ca_pem = std::fs::read(&self.client_ca_path)?;

        if let Some(chain_path) = self.server_chain_path.as_ref() {
            let chain_pem = std::fs::read(chain_path)?;
            if !cert_pem.ends_with(b"\n") {
                cert_pem.push(b'\n');

View on GitHub (pinned to 24c60942c5)

Solutions

1. Set GRPC_MTLS_CLIENT_CA_PATH to the CA certificate bundle used to verify clients
2. Confirm the CA file exists and is readable inside the container
3. If client-certificate verification is not desired, disable mTLS rather than omitting the CA
4. Validate the whole mTLS env set (key, crt, client CA) in a pre-deployment check

Example fix

# before
export GRPC_MTLS_SERVER_KEY_PATH=/etc/certs/server.key
export GRPC_MTLS_SERVER_CRT_PATH=/etc/certs/server.crt
# client CA missing -> error

# after
export GRPC_MTLS_SERVER_KEY_PATH=/etc/certs/server.key
export GRPC_MTLS_SERVER_CRT_PATH=/etc/certs/server.crt
export GRPC_MTLS_CLIENT_CA_PATH=/etc/certs/client_ca.crt

assert!(!env::var("GRPC_MTLS_CLIENT_CA_PATH").unwrap_or_default().trim().is_empty());

null

When it happens

Trigger: Enabling mTLS with server key and cert configured but no client CA path; unlike SERVER_CHAIN_PATH (optional), CLIENT_CA_PATH is mandatory.

Common situations: Configuring only the server side of mTLS and forgetting client verification; CA file not mounted as a secret; env name typos; staging configs diverging from production.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• {ENV_GRPC_MTLS_SERVER_KEY_PATH} must be set
• {ENV_GRPC_MTLS_SERVER_CRT_PATH} must be set
• {ENV_CACHE_WARM_SAMPLE_PCT}: {error}
• {misconfiguration}
• MM_LOCAL_SNAPSHOT: failed to read {path}: {e}

AI-assisted analysis of xai-org/x-algorithm@24c60942c5 (2026-08-28). Data as JSON: /api/errors/8b305c2a0bd52567. Report an issue: GitHub.