xai-org/x-algorithm · error · anyhow::Error

{ENV_GRPC_MTLS_SERVER_CRT_PATH} must be set

Error message

{ENV_GRPC_MTLS_SERVER_CRT_PATH} must be set

What it means

Raised in from_env when mTLS is enabled and GRPC_MTLS_SERVER_KEY_PATH was supplied, but GRPC_MTLS_SERVER_CRT_PATH is unset or empty. The server certificate path is mandatory whenever mTLS is on — note the key path alone is not enough.

Source

Thrown at visibility-filtering/config.rs:106

}

impl GrpcMtlsConfig {
    pub fn from_env() -> anyhow::Result<Option<Self>> {
        let enabled = parse_env_flag(std::env::var(ENV_GRPC_MTLS_ENABLED).ok().as_deref());

        if !enabled {
            return Ok(None);
        }

        let server_key_path = std::env::var(ENV_GRPC_MTLS_SERVER_KEY_PATH)
            .ok()
            .filter(|v| !v.is_empty())
            .ok_or_else(|| anyhow::anyhow!("{ENV_GRPC_MTLS_SERVER_KEY_PATH} must be set"))?;

        let server_crt_path = std::env::var(ENV_GRPC_MTLS_SERVER_CRT_PATH)
            .ok()
            .filter(|v| !v.is_empty())
            .ok_or_else(|| anyhow::anyhow!("{ENV_GRPC_MTLS_SERVER_CRT_PATH} must be set"))?;

        let server_chain_path = std::env::var(ENV_GRPC_MTLS_SERVER_CHAIN_PATH)
            .ok()
            .filter(|v| !v.is_empty());

        let client_ca_path = std::env::var(ENV_GRPC_MTLS_CLIENT_CA_PATH)
            .ok()
            .filter(|v| !v.is_empty())
            .ok_or_else(|| anyhow::anyhow!("{ENV_GRPC_MTLS_CLIENT_CA_PATH} must be set"))?;

        Ok(Some(Self {
            server_key_path,
            server_crt_path,
            server_chain_path,
            client_ca_path,
        }))
    }

View on GitHub (pinned to 24c60942c5)

Solutions

1. Set GRPC_MTLS_SERVER_CRT_PATH to the server certificate file path
2. Check for trailing whitespace/quotes or empty values injected by the deployment tool
3. Keep key and cert envs defined adjacent in deployment manifests so they're updated together
4. Add a config validation step that requires the key/cert pair as a unit

Example fix

# before
export GRPC_MTLS_SERVER_KEY_PATH=/etc/certs/server.key
# cert path missing -> error

# after
export GRPC_MTLS_SERVER_KEY_PATH=/etc/certs/server.key
export GRPC_MTLS_SERVER_CRT_PATH=/etc/certs/server.crt

assert!(!env::var("GRPC_MTLS_SERVER_CRT_PATH").unwrap_or_default().trim().is_empty());

null

When it happens

Trigger: Enabling mTLS with the key path configured but the server certificate path env var missing/empty (partial configuration).

Common situations: Templates that set the key but forget the cert env; cert mounted under a different filename; humans setting only one of the pair; empty-string defaults from orchestration tools.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• {ENV_GRPC_MTLS_SERVER_KEY_PATH} must be set
• {ENV_GRPC_MTLS_CLIENT_CA_PATH} must be set
• {ENV_CACHE_WARM_SAMPLE_PCT}: {error}
• {misconfiguration}
• MM_LOCAL_SNAPSHOT: failed to read {path}: {e}

AI-assisted analysis of xai-org/x-algorithm@24c60942c5 (2026-08-28). Data as JSON: /api/errors/16af58d123d79ced. Report an issue: GitHub.