{"record":{"id":"0af92351b9c0f9f2","repo":"hatoo/oha","slug":"failed-to-parse-client-auth-cert-key","errorCode":null,"errorMessage":"Failed to parse client_auth cert/key","messagePattern":"Failed to parse client_auth cert/key","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/tls_config.rs","lineNumber":108,"sourceCode":"    ) -> Self {\n        let new = |is_http2: bool| {\n            let mut connector_builder = native_tls::TlsConnector::builder();\n\n            if let Some(cacert_pem) = cacert_pem {\n                let cert = native_tls::Certificate::from_pem(cacert_pem)\n                    .expect(\"Failed to parse cacert_pem\");\n                connector_builder.add_root_certificate(cert);\n            }\n\n            if insecure {\n                connector_builder\n                    .danger_accept_invalid_certs(true)\n                    .danger_accept_invalid_hostnames(true);\n            }\n\n            if let Some((cert, key)) = client_auth {\n                let cert = native_tls::Identity::from_pkcs8(cert, key)\n                    .expect(\"Failed to parse client_auth cert/key\");\n                connector_builder.identity(cert);\n            }\n\n            if is_http2 {\n                connector_builder.request_alpns(&[\"h2\"]);\n            }\n\n            connector_builder\n                .build()\n                .expect(\"Failed to build native_tls::TlsConnector\")\n                .into()\n        };\n\n        Self {\n            no_alpn: new(false),\n            alpn_h2: new(true),\n        }\n    }","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/hatoo/oha/blob/4efba2d113d165aaaf7533f5d2893e7cc57ebfc1/src/tls_config.rs#L90-L126","documentation":"NativeTlsConnectors::new builds a client identity from the supplied client_auth (cert, key) bytes via native_tls::Identity::from_pkcs8 and panics with expect() when parsing fails. The faulting input is the client certificate/key pair: not PKCS#8 PEM, a mismatched cert/key pair, an encrypted key, or DER-encoded data.","triggerScenarios":"Thrown at src/tls_config.rs:108 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the key is unencrypted PKCS#8 PEM ('-----BEGIN PRIVATE KEY-----'); convert with 'openssl pkcs8 -topk8 -nocrypt -in key.pem'.","Verify the certificate and key are a matching pair (compare their public keys/moduli).","Concatenate cert and key is not required here — pass each as its own byte slice — but both must be valid PEM.","Re-export from the source keystore in PEM PKCS#8 form if the data is DER."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4efba2d113d165aaaf7533f5d2893e7cc57ebfc1","analyzedAt":"2026-09-09T16:24:23.306Z","contentChangedAt":"2026-09-09T16:24:23.306Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}