{"record":{"id":"03da1038f48ad07a","repo":"oauth2-proxy/oauth2-proxy","slug":"could-not-load-certificate-v","errorCode":null,"errorMessage":"could not load certificate: %v","messagePattern":"could not load certificate: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/proxyhttp/server.go","lineNumber":195,"sourceCode":"// The HTTPS server can be disabled by setting the SecureBindAddress to \"-\" or by\n// leaving it empty.\nfunc (s *server) setupTLSListener(opts Opts) error {\n\tif opts.SecureBindAddress == \"\" || opts.SecureBindAddress == \"-\" {\n\t\t// No HTTPS listener required\n\t\treturn nil\n\t}\n\n\tconfig := &tls.Config{\n\t\tMinVersion: tls.VersionTLS12, // default, override below\n\t\tMaxVersion: tls.VersionTLS13,\n\t\tNextProtos: []string{\"http/1.1\"},\n\t}\n\tif opts.TLS == nil {\n\t\treturn errors.New(\"no TLS config provided\")\n\t}\n\tcert, err := getCertificate(opts.TLS)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"could not load certificate: %v\", err)\n\t}\n\tconfig.Certificates = []tls.Certificate{cert}\n\n\tif len(opts.TLS.CipherSuites) > 0 {\n\t\tcipherSuites, err := parseCipherSuites(opts.TLS.CipherSuites)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"could not parse cipher suites: %v\", err)\n\t\t}\n\t\tconfig.CipherSuites = cipherSuites\n\t}\n\n\tif len(opts.TLS.MinVersion) > 0 {\n\t\tswitch opts.TLS.MinVersion {\n\t\tcase \"TLS1.2\":\n\t\t\tconfig.MinVersion = tls.VersionTLS12\n\t\tcase \"TLS1.3\":\n\t\t\tconfig.MinVersion = tls.VersionTLS13\n\t\tdefault:","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/oauth2-proxy/oauth2-proxy/blob/33c2eb92dea78204f7a18bc2dfdbccc220f39257/pkg/proxyhttp/server.go#L177-L213","documentation":"Wrap error in setupTLSListener: getCertificate failed while loading the TLS key/cert pair for the HTTPS listener (nil secret source, unreadable file, or X509KeyPair parse failure), so TLS cannot be set up at startup.","triggerScenarios":"NewServer → setupTLSListener where opts.TLS is non-nil but getCertificate fails because KeyFile/CertFile do not exist, are unreadable, are not valid PEM, or the key does not match the certificate.","commonSituations":"Wrong paths in container images (file not copied), expired/reissued certs replaced without updating the key, concatenated files with trailing garbage, running as a user without read permission on the key.","solutions":["Read the wrapped error to identify the root cause (file not found, PEM decode failure, key mismatch)","Verify CertFile and KeyFile paths exist and are readable: test with `openssl x509 -in cert.pem` and `openssl rsa -in key.pem -check`","Confirm the cert and key belong together by comparing their public key moduli","If using Secret/mounted secrets, confirm the mount happened and permissions allow the process to read them"],"exampleFix":"// before\nserver, _ := NewServer(ctx, Opts{TLS: &TLS{CertFile: \"/etc/ssl/cert.pem\", KeyFile: \"/etc/ssl/key.pem\"}}) // key not mounted\n// after\nserver, _ := NewServer(ctx, Opts{TLS: &TLS{CertFile: \"/etc/ssl/tls/tls.crt\", KeyFile: \"/etc/ssl/tls/tls.key\"}}) // verified mount","handlingStrategy":"validation","validationCode":"// Pre-flight check mirroring getCertificate\nif _, err := tls.LoadX509KeyPair(\"/etc/ssl/tls.crt\", \"/etc/ssl/tls.key\"); err != nil {\n    return fmt.Errorf(\"TLS keypair unusable before server start: %w\", err)\n}","typeGuard":"func certFilesReadable(certFile, keyFile string) bool {\n    c, err1 := os.ReadFile(certFile)\n    k, err2 := os.ReadFile(keyFile)\n    return err1 == nil && err2 == nil &&\n        bytes.Contains(c, []byte(\"BEGIN CERTIFICATE\")) &&\n        (bytes.Contains(k, []byte(\"PRIVATE KEY\")))\n}","tryCatchPattern":"srv, err := NewServer(ctx, opts)\nif err != nil && strings.Contains(err.Error(), \"could not load certificate\") {\n    return fmt.Errorf(\"check TLS cert/key paths, permissions, and that they form a matching pair: %w\", err)\n}","preventionTips":["Verify cert and key load with openssl before every deploy","Confirm secret mounts land at the exact configured paths","Keep cert and key versions in sync when rotating certificates","Ensure the process user can read the private key file"],"tags":["tls","certificate","configuration"],"backgroundTag":"invalid-config-value","analyzedSha":"33c2eb92dea78204f7a18bc2dfdbccc220f39257","analyzedAt":"2026-09-06T08:51:53.077Z","contentChangedAt":"2026-09-06T08:51:53.077Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}