BerriAI/litellm · error · RuntimeError

Could not authenticate to Vault via TLS cert: {e}

Error message

Could not authenticate to Vault via TLS cert: {e}

What it means

TLS certificate authentication failure for Vault: the mutual-TLS login request using the configured client cert/key (HCP_VAULT_CLIENT_CERT/KEY) failed — bad certificate files, wrong role, or an HTTP error — so no Vault token was returned.

Source

Thrown at litellm/secret_managers/hashicorp_secret_manager.py:200

        headers: Final = {}
        if hasattr(self, "vault_namespace") and self.vault_namespace:
            headers["X-Vault-Namespace"] = self.vault_namespace
        try:
            # We use the client cert and key for mutual TLS
            client: Final = httpx.Client(cert=(self.tls_cert_path, self.tls_key_path))
            resp: Final = client.post(
                login_url,
                headers=headers,
                json=self._get_tls_cert_auth_body(),
            )
            resp.raise_for_status()
            token: Final = resp.json()["auth"]["client_token"]
            _lease_duration: Final = resp.json()["auth"]["lease_duration"]
            verbose_logger.debug("Successfully obtained Vault token via TLS cert auth.")
            self.cache.set_cache(key="hcp_vault_token", value=token, ttl=_lease_duration)
            return token
        except Exception as e:
            raise RuntimeError(f"Could not authenticate to Vault via TLS cert: {e}")

    def _get_tls_cert_auth_body(self) -> dict:
        return {"name": self.vault_cert_role}

    def get_url(
        self,
        secret_name: str,
        namespace: str | None = None,
        mount_name: str | None = None,
        path_prefix: str | None = None,
    ) -> str:
        """
        Constructs the Vault URL for KV v2 secrets.

        Format: {VAULT_ADDR}/v1/{NAMESPACE}/{MOUNT_NAME}/data/{PATH_PREFIX}/{SECRET_NAME}

        Examples:
        - Default: http://127.0.0.1:8200/v1/secret/data/mykey

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Check HCP_VAULT_CLIENT_CERT/HCP_VAULT_CLIENT_KEY point to valid, unexpired cert and key files.
2. Inspect {e}; ensure the cert auth role is configured in Vault for this certificate.

When it happens

Trigger: Thrown at litellm/secret_managers/hashicorp_secret_manager.py:200 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/28901b999fd5aa99. Report an issue: GitHub.