tls_manager.go: handle case when either TLS pair files exist
What the developer wrote
Authored by Thiago Romão Barcala
tls_manager.go: handle case when either TLS pair files exist
What changed, and why it matters
This small change fixes a logic bug in how LND decides whether to create its TLS certificate and private key. Previously, if either the certificate or the key file existed, the program skipped creating a new pair and tried to handle encryption settings instead. After the fix, it only skips creation when both files exist. The old behavior could leave LND running with a mismatched certificate/key pair (for example, a new certificate paired with an old key, or vice versa), which can break TLS connections to the node or, in rare cases, affect how private keys are protected on disk.
Apply the patch and consider adding explicit validation that an existing cert and key actually match each other cryptographically, plus a recovery path that regenerates the pair when a mismatch is detected. Operators who have experienced TLS connection failures or who have only one of tls.cert/tls.key present should regenerate their TLS pair after upgrading.
Security signals we found
TLS key/cert pair mismatch risk due to incorrect boolean operator
Possible bypass of fresh certificate generation when one file is missing
Potential inconsistency in TLSEncryptKey handling when only one file exists
Evidence from the diff
In tls_manager.go, generateCertPair() changed the condition from if certExists || keyExists to if certExists && keyExists. The original OR condition meant that if only one member of the TLS pair was present, the function would not generate a fresh pair and would proceed to the TLSEncryptKey discrepancy-handling block. That could result in a mismatched cert/key pair, TLS handshake failures, or inconsistent key-encryption state. The AND condition ensures generation runs unless a complete, existing pair is already on disk. The patch is minimal (one operator change) and does not add new validation or recovery logic for the mismatched-pair case, so it is a partial fix.
Changed components
lnd/tls_manager.gogenerateCertPair()TLS certificate and key generation/renewalInspect captured patch +2 / −2
diff --git a/tls_manager.go b/tls_manager.go
index 076cf44..242fd37 100644
--- a/tls_manager.go
+++ b/tls_manager.go
@@ -208,8 +208,8 @@ func (t *TLSManager) generateOrRenewCert() (*tls.Config, error) {
// is already written to disk, this function overwrites the plaintext key with
// the encrypted form.
func (t *TLSManager) generateCertPair(keyRing keychain.SecretKeyRing) error {
- // Ensure we create TLS key and certificate if they don't exist.
- if lnrpc.FileExists(t.cfg.TLSCertPath) ||
+ // Ensure we create TLS key and certificate if they don't both exist.
+ if lnrpc.FileExists(t.cfg.TLSCertPath) &&
lnrpc.FileExists(t.cfg.TLSKeyPath) {
// Handle discrepencies related to the TLSEncryptKey setting.
Why this scored 34/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.