{"record":{"id":"10d1f35e1d640069","repo":"hashicorp/terraform","slug":"client-private-key-pem-is-set-but-client-certifica","errorCode":null,"errorMessage":"client_private_key_pem is set but client_certificate_pem is not","messagePattern":"client_private_key_pem is set but client_certificate_pem is not","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/http/backend.go","lineNumber":279,"sourceCode":"\t\tconfigVal, \"client_ca_certificate_pem\",\n\t\t\"TF_HTTP_CLIENT_CA_CERTIFICATE_PEM\", cty.StringVal(\"\"),\n\t).AsString()\n\tclientCertificatePem := backendbase.GetAttrEnvDefaultFallback(\n\t\tconfigVal, \"client_certificate_pem\",\n\t\t\"TF_HTTP_CLIENT_CERTIFICATE_PEM\", cty.StringVal(\"\"),\n\t).AsString()\n\tclientPrivateKeyPem := backendbase.GetAttrEnvDefaultFallback(\n\t\tconfigVal, \"client_private_key_pem\",\n\t\t\"TF_HTTP_CLIENT_PRIVATE_KEY_PEM\", cty.StringVal(\"\"),\n\t).AsString()\n\tif !skipCertVerification && clientCACertificatePem == \"\" && clientCertificatePem == \"\" && clientPrivateKeyPem == \"\" {\n\t\treturn nil\n\t}\n\tif clientCertificatePem != \"\" && clientPrivateKeyPem == \"\" {\n\t\treturn fmt.Errorf(\"client_certificate_pem is set but client_private_key_pem is not\")\n\t}\n\tif clientPrivateKeyPem != \"\" && clientCertificatePem == \"\" {\n\t\treturn fmt.Errorf(\"client_private_key_pem is set but client_certificate_pem is not\")\n\t}\n\n\t// TLS configuration is needed; create an object and configure it\n\tvar tlsConfig tls.Config\n\tclient.HTTPClient.Transport.(*http.Transport).TLSClientConfig = &tlsConfig\n\n\tif skipCertVerification {\n\t\t// ignores TLS verification\n\t\ttlsConfig.InsecureSkipVerify = true\n\t}\n\tif clientCACertificatePem != \"\" {\n\t\t// trust servers based on a CA\n\t\ttlsConfig.RootCAs = x509.NewCertPool()\n\t\tif !tlsConfig.RootCAs.AppendCertsFromPEM([]byte(clientCACertificatePem)) {\n\t\t\treturn errors.New(\"failed to append certs\")\n\t\t}\n\t}\n\tif clientCertificatePem != \"\" && clientPrivateKeyPem != \"\" {","sourceCodeStart":261,"sourceCodeEnd":297,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/http/backend.go#L261-L297","documentation":"Inverse of 245: client_private_key_pem (or TF_HTTP_CLIENT_PRIVATE_KEY_PEM) is set but client_certificate_pem is empty. tls.X509KeyPair needs both, so configureTLS rejects the half-configured pair at Configure time rather than failing later in the handshake.","triggerScenarios":"Setting client_private_key_pem without client_certificate_pem, or exporting only TF_HTTP_CLIENT_PRIVATE_KEY_PEM. Fires during `terraform init`.","commonSituations":"Cert injected by a different secret path that was skipped; key rotated but new cert not yet provisioned; leftover env var from a previous mTLS setup.","solutions":["Add the matching client_certificate_pem (PEM).","Remove client_private_key_pem if mTLS is not intended.","Synchronize both env vars so they are always provisioned as a pair."],"exampleFix":"// before\nbackend \"http\" {\n  address               = \"https://state.corp\"\n  client_private_key_pem = file(\"client.key\")\n}\n// after\nbackend \"http\" {\n  address                = \"https://state.corp\"\n  client_certificate_pem = file(\"client.crt\")\n  client_private_key_pem = file(\"client.key\")\n}","handlingStrategy":"validation","validationCode":"func validateMTLSPair(cert, key string) error {\n  if key != \"\" && cert == \"\" {\n    return fmt.Errorf(\"client_private_key_pem set without client_certificate_pem\")\n  }\n  return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat cert+key as inseparable in secret templating.","Fail fast in config rendering if only one is present.","Pair the env vars in deployment manifests."],"tags":["config","mtls","tls","http-backend","terraform"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}