Netflix/chaosmonkey · error
cannot use both p12 and x509 certs, choose one
Error message
cannot use both p12 and x509 certs, choose one
What it means
New() configures the Spinnaker client with TLS client authentication using either a PKCS#12 (.p12) cert file (certPath + password) or a PEM x509 cert/key pair (x509Cert + x509Key). This error is a config validation guard: both certPath and x509Cert were provided, which is ambiguous since the client can only use one auth mechanism.
Source
Thrown at spinnaker/spinnaker.go:145
password, err = decryptor.Decrypt(encryptedPassword)
if err != nil {
return Spinnaker{}, err
}
}
return New(spinnakerEndpoint, certPath, password, x509Cert, x509Key, user)
}
// New returns a Spinnaker using a .p12 cert at certPath encrypted with
// password or x509 cert. The user argument identifies the email address of the user which is
// sent in the payload of the terminateInstances task API call
func New(endpoint string, certPath string, password string, x509Cert string, x509Key string, user string) (Spinnaker, error) {
var client *http.Client
var err error
if x509Cert != "" && certPath != "" {
return Spinnaker{}, errors.New("cannot use both p12 and x509 certs, choose one")
}
if certPath != "" {
pfxData, err := ioutil.ReadFile(certPath)
if err != nil {
return Spinnaker{}, errors.Wrapf(err, "failed to read file %s", certPath)
}
client, err = getClient(pfxData, password)
if err != nil {
return Spinnaker{}, err
}
} else if x509Cert != "" {
client, err = getClientX509(x509Cert, x509Key)
if err != nil {
return Spinnaker{}, err
}
} else {View on GitHub (pinned to eaa28fb761)
Solutions
- Remove the p12 certificate path (spinnaker.certificate) from your config if you intend to use x509Cert/x509Key
- Remove the x509Cert/x509Key entries from your config if you intend to use the p12 cert with its password
- Pass "" for either certPath or x509Cert when calling New() directly so exactly one auth mechanism is configured
Example fix
// before spinnaker: endpoint: https://spinnaker.example.com certificate: /etc/chaosmonkey/spinnaker.p12 x509Cert: /etc/chaosmonkey/client.crt x509Key: /etc/chaosmonkey/client.key // after spinnaker: endpoint: https://spinnaker.example.com x509Cert: /etc/chaosmonkey/client.crt x509Key: /etc/chaosmonkey/client.key
Defensive patterns
Strategy: validation
Validate before calling
func validateCertConfig(certPath, x509Cert string) error {
if certPath != "" && x509Cert != "" {
return fmt.Errorf("cannot use both p12 (%s) and x509 (%s) certs, choose one", certPath, x509Cert)
}
return nil
}
// call before spinnaker.New(...) Prevention
- Keep exactly one TLS auth style in the chaosmonkey config; comment out the other
- When migrating from p12 to x509, delete the old certificate entry in the same change
- Add a startup config check that rejects both certificate styles
- Document which cert style your Spinnaker endpoint requires
When it happens
Trigger: Calling New(endpoint, certPath, password, x509Cert, x509Key, user) with both certPath != "" and x509Cert != "". Via NewFromConfig, this happens when the chaosmonkey config file sets both the p12 certificate option (spinnaker.certificate) and the x509 options (spinnaker.x509Cert / x509Key).
Common situations: Migrating from p12 to x509 certs and leaving the old certificate entry in the config file; merging default and environment-specific config files that each specify a different cert style; copy-pasting example configs that use different auth styles.
Related errors
- the account name doesn't exist
- retrieve cloud provider failed
- unsupported error counter: %s
- %s not specified
- unknown group: %v
AI-assisted analysis of Netflix/chaosmonkey@eaa28fb761 (2026-09-03).
Data as JSON: /api/errors/83fbbc6542bbf88f.
Report an issue: GitHub.