{"record":{"id":"0195a9571d47a5ee","repo":"hashicorp/nomad","slug":"failed-to-load-cert-key-pair-v","errorCode":null,"errorMessage":"Failed to load cert/key pair: %v","messagePattern":"Failed to load cert/key pair: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"helper/tlsutil/config.go","lineNumber":209,"sourceCode":"\t\treturn fmt.Errorf(\"Failed to parse any valid certificates in CA file: %s\", c.CAFile)\n\t}\n\n\treturn nil\n}\n\n// LoadKeyPair is used to open and parse a certificate and key file\nfunc (c *Config) LoadKeyPair() (*tls.Certificate, error) {\n\tif c.CertFile == \"\" || c.KeyFile == \"\" {\n\t\treturn nil, nil\n\t}\n\n\tif c.KeyLoader == nil {\n\t\treturn nil, fmt.Errorf(\"No Keyloader object to perform LoadKeyPair\")\n\t}\n\n\tcert, err := c.KeyLoader.LoadKeyPair(c.CertFile, c.KeyFile)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"Failed to load cert/key pair: %v\", err)\n\t}\n\treturn cert, err\n}\n\n// OutgoingTLSConfig generates a TLS configuration for outgoing\n// requests. It will return a nil config if this configuration should\n// not use TLS for outgoing connections. Provides a callback to\n// fetch certificates, allowing for reloading on the fly.\nfunc (c *Config) OutgoingTLSConfig() (*tls.Config, error) {\n\t// If VerifyServerHostname is true, that implies VerifyOutgoing\n\tif c.VerifyServerHostname {\n\t\tc.VerifyOutgoing = true\n\t}\n\tif !c.VerifyOutgoing {\n\t\treturn nil, nil\n\t}\n\t// Create the tlsConfig\n\ttlsConfig := &tls.Config{","sourceCodeStart":191,"sourceCodeEnd":227,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/helper/tlsutil/config.go#L191-L227","documentation":"LoadKeyPair delegates to Config.KeyLoader.LoadKeyPair(CertFile, KeyFile) to read and parse the certificate/private-key pair into a tls.Certificate. Any failure from the loader (unreadable file, PEM parse error, mismatched key, encrypted key) is wrapped in this error. It means TLS identity files could not be loaded.","triggerScenarios":"CertFile and KeyFile are set and a KeyLoader exists, but loading fails — missing/unreadable files, invalid PEM, certificate and key not matching, unsupported key format (e.g. encrypted PKCS#8 without password), or expired/invalid cert bytes.","commonSituations":"Wrong key paired with the cert after rotation; cert file actually containing a chain without the key or vice versa; permissions blocking the process user; keys generated with algorithms/options the Go TLS stack cannot parse.","solutions":["Read the wrapped %v cause and fix that specific problem (path, permission, or parse error).","Verify the pair matches: compare modulus/public keys (openssl x509 -noout -modulus vs openssl rsa -noout -modulus).","Validate files with openssl x509 / openssl pkey; re-export the key in an unencrypted PKCS#8/PEM format Go supports.","Ensure CertFile holds the leaf cert (chain first) and KeyFile the corresponding private key, both readable by the process."],"exampleFix":"// before\ncfg.KeyFile = \"old-key.pem\" // key regenerated, no longer matches cert\n// after\ncfg.CertFile = \"new-cert.pem\"\ncfg.KeyFile = \"new-key.pem\" // matching pair from the same issuance","handlingStrategy":"validation","validationCode":"func validateKeyPair(certPath, keyPath string) error {\n    certPEM, err := os.ReadFile(certPath); if err != nil { return err }\n    keyPEM, err := os.ReadFile(keyPath); if err != nil { return err }\n    cert, err := tls.X509KeyPair(certPEM, keyPEM)\n    if err != nil { return fmt.Errorf(\"cert/key mismatch or unparsable: %w\", err) }\n    leaf, err := x509.ParseCertificate(cert.Certificate[0])\n    if err != nil { return err }\n    if time.Now().After(leaf.NotAfter) { return fmt.Errorf(\"certificate expired %s\", leaf.NotAfter) }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"cert, err := cfg.LoadKeyPair()\nif err != nil && strings.Contains(err.Error(), \"Failed to load cert/key pair\") {\n    if verr := validateKeyPair(cfg.CertFile, cfg.KeyFile); verr != nil {\n        return fmt.Errorf(\"TLS identity files invalid: %w\", verr)\n    }\n    return err\n}","preventionTips":["Validate cert/key pairs with tls.X509KeyPair (or openssl) before deployment and after each rotation.","Always rotate cert and key together from the same issuance.","Ensure both files are readable by the service user and use unencrypted, Go-supported key formats (PKCS#8/PEM).","Monitor certificate expiry and rotate before NotAfter."],"tags":["tls","certificate","private-key","configuration"],"backgroundTag":"cert-key-pair-load-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}