{"record":{"id":"13663d2242fef570","repo":"nsqio/nsq","slug":"http-client-tls-key-must-be-specified-with-htt","errorCode":null,"errorMessage":"--http-client-tls-key must be specified with --http-client-tls-cert","messagePattern":"--http-client-tls-key must be specified with --http-client-tls-cert","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nsqadmin/nsqadmin.go","lineNumber":53,"sourceCode":"\tif opts.Logger == nil {\n\t\topts.Logger = log.New(os.Stderr, opts.LogPrefix, log.Ldate|log.Ltime|log.Lmicroseconds)\n\t}\n\n\tn := &NSQAdmin{\n\t\tnotifications: make(chan *AdminAction),\n\t}\n\tn.swapOpts(opts)\n\n\tif len(opts.NSQDHTTPAddresses) == 0 && len(opts.NSQLookupdHTTPAddresses) == 0 {\n\t\treturn nil, errors.New(\"--nsqd-http-address or --lookupd-http-address required\")\n\t}\n\n\tif len(opts.NSQDHTTPAddresses) != 0 && len(opts.NSQLookupdHTTPAddresses) != 0 {\n\t\treturn nil, errors.New(\"use --nsqd-http-address or --lookupd-http-address not both\")\n\t}\n\n\tif opts.HTTPClientTLSCert != \"\" && opts.HTTPClientTLSKey == \"\" {\n\t\treturn nil, errors.New(\"--http-client-tls-key must be specified with --http-client-tls-cert\")\n\t}\n\n\tif opts.HTTPClientTLSKey != \"\" && opts.HTTPClientTLSCert == \"\" {\n\t\treturn nil, errors.New(\"--http-client-tls-cert must be specified with --http-client-tls-key\")\n\t}\n\n\tn.httpClientTLSConfig = &tls.Config{\n\t\tInsecureSkipVerify: opts.HTTPClientTLSInsecureSkipVerify,\n\t}\n\tif opts.HTTPClientTLSCert != \"\" && opts.HTTPClientTLSKey != \"\" {\n\t\tcert, err := tls.LoadX509KeyPair(opts.HTTPClientTLSCert, opts.HTTPClientTLSKey)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to LoadX509KeyPair %s, %s - %s\",\n\t\t\t\topts.HTTPClientTLSCert, opts.HTTPClientTLSKey, err)\n\t\t}\n\t\tn.httpClientTLSConfig.Certificates = []tls.Certificate{cert}\n\t}\n\tif opts.HTTPClientTLSRootCAFile != \"\" {","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/nsqio/nsq/blob/85cf10c09c6c3c86160d6f0eb156f62d0efc1648/nsqadmin/nsqadmin.go#L35-L71","documentation":"nsqadmin can authenticate to nsqd/nsqlookupd with a client certificate when those servers require mTLS. The two options form a pair: opts.HTTPClientTLSCert is set while opts.HTTPClientTLSKey is empty, so tls.LoadX509KeyPair could never be called and New() fails fast with a pointer to the missing flag.","triggerScenarios":"Launching nsqadmin with --http-client-tls-cert=/path/cert.pem but no --http-client-tls-key. The check is purely on empty-string flags and runs before any file is opened, so a wrong path does NOT trigger this error (that surfaces later as a LoadX509KeyPair failure).","commonSituations":"Cert and key concatenated into one PEM and only the cert flag set; copy-pasting only one line of a two-line TLS config; key managed by a secret store that failed to inject its flag.","solutions":["Add the matching key: --http-client-tls-key=/path/key.pem.","Verify both paths point to a valid PEM pair (openssl x509 -in cert.pem -noout / openssl rsa -in key.pem -check).","If the CA rather than client identity was intended, use --http-client-tls-ca-cert instead of the cert flag."],"exampleFix":"# before\nnsqadmin --lookupd-http-address=10.0.0.2:4161 --http-client-tls-cert=/etc/nsq/client.pem\n# after\nnsqadmin --lookupd-http-address=10.0.0.2:4161 --http-client-tls-cert=/etc/nsq/client.pem --http-client-tls-key=/etc/nsq/client.key","handlingStrategy":"validation","validationCode":"func validateClientTLSPair(cert, key string) error {\n\tif (cert == \"\") != (key == \"\") {\n\t\treturn errors.New(\"--http-client-tls-cert and --http-client-tls-key must be set together\")\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Store cert and key as one secret object and template both flags from it, so they are always emitted together.","Add a preflight check that both files exist before starting nsqadmin."],"tags":["nsq","nsqadmin","cli","config","tls"],"backgroundTag":null,"analyzedSha":"85cf10c09c6c3c86160d6f0eb156f62d0efc1648","analyzedAt":"2026-08-16T00:53:05.009Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}