From f1f9f1807990c7e88177865c3843e36585a85718 Mon Sep 17 00:00:00 2001
From: JasonVranek <jasonvranek@gmail.com>
Date: Wed, 24 Jun 2026 11:23:30 -0700
Subject: [PATCH] Install TLS provider prior start_manager to resolve Dirk
 panic bug

---
 crates/signer/src/service.rs | 55 ++++++++++++++++++++----------------
 1 file changed, 30 insertions(+), 25 deletions(-)

diff --git a/crates/signer/src/service.rs b/crates/signer/src/service.rs
index b3a3045b..710d7ea6 100644
--- a/crates/signer/src/service.rs
+++ b/crates/signer/src/service.rs
@@ -97,6 +97,10 @@ impl SigningService {
         let module_ids: Vec<String> =
             config.mod_signing_configs.keys().cloned().map(Into::into).collect();
 
+        if config.tls_certificates.is_some() || config.dirk.is_some() {
+            install_crypto_provider().await?;
+        }
+
         let state = SigningState {
             manager: Arc::new(RwLock::new(start_manager(config.clone()).await?)),
             jwts: Arc::new(ParkingRwLock::new(config.mod_signing_configs)),
@@ -166,31 +170,6 @@ impl SigningService {
         });
 
         let server_result = if let Some(tls_config) = config.tls_certificates {
-            if CryptoProvider::get_default().is_none() {
-                // Install the AWS-LC provider if no default is set, usually for CI
-                debug!("Installing AWS-LC as default TLS provider");
-                let mut attempts = 0;
-                loop {
-                    match aws_lc_rs::default_provider().install_default() {
-                        Ok(_) => {
-                            debug!("Successfully installed AWS-LC as default TLS provider");
-                            break;
-                        }
-                        Err(e) => {
-                            if attempts >= 3 {
-                                return Err(eyre::eyre!(
-                                    "Exceeded maximum attempts to install AWS-LC as default TLS provider: {e:?}"
-                                ));
-                            }
-                            error!(
-                                "Failed to install AWS-LC as default TLS provider: {e:?}. Retrying..."
-                            );
-                            attempts += 1;
-                        }
-                    }
-                }
-            }
-
             let tls_config = RustlsConfig::from_pem(tls_config.0, tls_config.1).await?;
             axum_server::bind_rustls(config.endpoint, tls_config)
                 .serve(
@@ -740,6 +719,32 @@ async fn start_manager(config: StartSignerConfig) -> eyre::Result<SigningManager
     }
 }
 
+async fn install_crypto_provider() -> eyre::Result<()> {
+    if CryptoProvider::get_default().is_none() {
+        // Install the AWS-LC provider if no default is set, usually for CI
+        debug!("Installing AWS-LC as default TLS provider");
+        let mut attempts = 0;
+        loop {
+            match aws_lc_rs::default_provider().install_default() {
+                Ok(_) => {
+                    debug!("Successfully installed AWS-LC as default TLS provider");
+                    break;
+                }
+                Err(e) => {
+                    if attempts >= 3 {
+                        return Err(eyre::eyre!(
+                            "Exceeded maximum attempts to install AWS-LC as default TLS provider: {e:?}"
+                        ));
+                    }
+                    error!("Failed to install AWS-LC as default TLS provider: {e:?}. Retrying...");
+                    attempts += 1;
+                }
+            }
+        }
+    }
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
     use alloy::primitives::b256;