11 Srp
2026
11 Srp
'26
14:29
Thanks for the reply, it makes sense that failing to load the QUIC/TLS
certificates is a critical issue.
The main reason I wrote the patch was to avoid a circular dependency of
needing a Do53 server to get the certificates for QUIC/TLS.
On 11/08/2026 12:50, Daniel Salzman via knot-dns-users wrote:
Hi Max!
I'm not sure this change is a good idea. If you have enabled QUIC/TLS
in the configuration, you probably expect it to work.
Our previous fix only ensures that the server doesn't crash during
teardown.
Daniel
On 8/11/26 13:39, Max Hearnden via knot-dns-users wrote:
knotd still fails to start if it can't load
certificates or keys.
This appears to be a bug given that "knotd: server crashes when it
fails to load a QUIC/TLS key" is in the release notes for knot-dns
v3.5.6.
Below is a patch that allows the server to start if knotd can't load
the certificates/keys.
---
src/knot/server/server.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/src/knot/server/server.c b/src/knot/server/server.c
index 8de6f1a8f..e03178144 100644
--- a/src/knot/server/server.c
+++ b/src/knot/server/server.c
@@ -824,9 +824,10 @@ static int configure_sockets(conf_t *conf,
server_t *s)
s->quic_active = conf->cache.xdp_quic > 0 || convent_quic > 0
|| quic_rmt_count(conf, C_QUIC)
-- 0;
s->tls_active = convent_tls > 0 || quic_rmt_count(conf, C_TLS)
0;
if (s->quic_active ||
s->tls_active) {
- if (init_creds(conf, s) != KNOT_EOK) {
- server_deinit_iface_list(newlist, nifs);
- return KNOT_ERROR;
+ int ret;
+ if ((ret = init_creds(conf, s)) != KNOT_EOK) {
+ log_error("failed to configure server credentials (%s)",
+ knot_strerror(ret));
}
}