RustFS Startup Failed: TLS Certificate Directory Not Found

[bin-ran]

Describe the bug

TLS cannot be initialized when RUSTFS_TLS_PATH is configured.

Using the same TLS certificate directory and the same startup configuration:

• 1.0.0-beta.2 works as expected
• 1.0.0-beta.3 fails
• 1.0.0-beta.4 fails

To Reproduce

1. Prepare a TLS certificate directory.
2. Set RUSTFS_TLS_PATH to that directory, for example /path/to/certs/.
3. Start RustFS.
4. Observe that TLS initialization fails on 1.0.0-beta.3 and 1.0.0-beta.4.

Sanitized log:

[FATAL] Server encountered an error and is shutting down:
TLS is explicitly configured via RUSTFS_TLS_PATH/tls_path='/path/to/certs/'
but TLS acceptor initialization failed:
TLS material I/O error: failed to discover TLS certificates under '/path/to/certs/':
The certificate directory does not exist or is not a directory: /path/to/certs/

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: [e.g. iOS]
• Browser [e.g. chrome, safari]
• Version [e.g. 22]

Smartphone (please complete the following information):

• Device: [e.g. iPhone6]
• OS: [e.g. iOS8.1]
• Browser [e.g. stock browser, safari]
• Version [e.g. 22]

Additional context
Add any other context about the problem here.

[houseme]

Root cause confirmed and fixed on the fix/fix-issues-3053 branch.

What changed:

• server-side TLS startup now validates the configured RUSTFS_TLS_PATH explicitly
• root single-cert layouts (rustfs_cert.pem + rustfs_key.pem in the TLS directory) are handled correctly
• multi-cert/SNI layouts are preserved when domain-specific certificate directories are present
• startup errors are now more precise for:
  • missing TLS directory
  • non-directory TLS path
  • missing root cert/key files
  • empty TLS directories with no usable server certificate material

Regression coverage added for:

• trailing-slash TLS paths
• symlinked TLS directories
• missing / invalid TLS paths
• empty TLS directories
• multi-cert directory layouts
• mixed root + domain-cert layouts to ensure SNI behavior is not silently downgraded

Verification:

• cargo test -p rustfs --lib tls_material -- --nocapture
• make pre-commit

Result:

• the startup regression reported in RustFS Startup Failed: TLS Certificate Directory Not Found #3053 is fixed on the branch
• full pre-commit checks pass

[bin-ran]

@houseme Was there something wrong with my previous configuration? Why couldn't it start even after upgrading to version 1.0.0-beta.5?

[houseme]

Do the user running the program and the permissions of the certificate directory match?

[houseme]

Currently, certificates for multiple different domains are configured. Are there any issues with the certificates for any of these domains? Thank you!

[bin-ran]

All operations were performed using the root user.

[bin-ran]

1. Permissions: The program is running as root, so permission mismatches should not be the issue.
2. Configuration: I currently only have one domain configured. The folder is named exactly after the domain (e.g., xxx.xxx.cn), and the certificates are inside.
3. Context: This setup worked perfectly in version bate.2. The issue appeared after upgrading to the current version.

[houseme]

rustfs_cert.pem

-----BEGIN CERTIFICATE-----
MIIBoTCCAUigAwIBAgIUQebL0N9sDk/uO4ZkpDIV14mi/QcwCQYHKoZIzj0EATAv
MQ8wDQYDVQQDDAbmtYvor5UxDzANBgNVBAoMBua1i+ivlTELMAkGA1UEBhMCQ04w
HhcNMjYwNTI2MDI1MDAwWhcNMjcwMTAxMDI1MDAwWjBVMQswCQYDVQQGEwJDTjEQ
MA4GA1UECAwHYmVpamluZzEQMA4GA1UEBwwHYmVpamluZzEPMA0GA1UECgwGMTIz
NDU2MREwDwYDVQQDDAhkZW1vLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IA
BB4s6bzsCWrHzYPQqNn8ISwpz7PG46clF2NW1IhECrM3EHl0bqE7UAMhS69E/bfn
REBNlgu2m+r3An8eVGddJ6GjHTAbMAsGA1UdEQQEMAKCADAMBgNVHRMBAf8EAjAA
MAkGByqGSM49BAEDSAAwRQIhANXrCFPRFZBrgoPBftez3tSHWmnUnlFApGgtV7eM
1MbMAiB8a9TsSgtIZdzlLrIlEL1PNW1rY8SoS5e+NYz725RNpA==
-----END CERTIFICATE-----

rustfs_key.pem

-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgC3R8Mt762fycQSeD
CNu8faU0CHid16RlsrU6UmpLOeKhRANCAAQeLOm87Alqx82D0KjZ/CEsKc+zxuOn
JRdjVtSIRAqzNxB5dG6hO1ADIUuvRP2350RATZYLtpvq9wJ/HlRnXSeh
-----END PRIVATE KEY-----

Try using this test certificate to see if it can be launched. It supports TLS services. @bin-ran

[houseme]

rustfs --version Verify whether the currently used version is correct, and run rustfs info --all for more detailed information.

It is recommended to set the log level to “info” so that response log information can be viewed. Please also provide the log contents for analysis.