{"record":{"id":"14d99e14b391f26e","repo":"ory/hydra","slug":"unable-to-load-tls-certificate-for-interface-s","errorCode":null,"errorMessage":"unable to load TLS certificate for interface %s: %w","messagePattern":"unable to load TLS certificate for interface (.+?): %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"oryx/configx/serve.go","lineNumber":111,"sourceCode":"func (p *Provider) TLS(prefix string, defaults TLS) TLS {\n\tprefix = cleanPrefix(prefix)\n\n\treturn TLS{\n\t\tEnabled:              p.BoolF(prefix+\"enabled\", defaults.Enabled),\n\t\tAllowTerminationFrom: p.StringsF(prefix+\"allow_termination_from\", defaults.AllowTerminationFrom),\n\t\tCertBase64:           p.StringF(prefix+\"cert.base64\", defaults.CertBase64),\n\t\tKeyBase64:            p.StringF(prefix+\"key.base64\", defaults.KeyBase64),\n\t\tCertPath:             p.StringF(prefix+\"cert.path\", defaults.CertPath),\n\t\tKeyPath:              p.StringF(prefix+\"key.path\", defaults.KeyPath),\n\t}\n}\n\nfunc (t *TLS) GetCertFunc(ctx context.Context, l *logrusx.Logger, ifaceName string) (tlsx.CertFunc, error) {\n\tswitch {\n\tcase t.CertBase64 != \"\" && t.KeyBase64 != \"\":\n\t\tcert, err := tlsx.CertificateFromBase64(t.CertBase64, t.KeyBase64)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to load TLS certificate for interface %s: %w\", ifaceName, err)\n\t\t}\n\t\tl.Infof(\"Setting up HTTPS for %s\", ifaceName)\n\t\treturn func(*tls.ClientHelloInfo) (*tls.Certificate, error) { return &cert, nil }, nil\n\tcase t.CertPath != \"\" && t.KeyPath != \"\":\n\t\terrs := make(chan error, 1)\n\t\tgetCert, err := tlsx.GetCertificate(ctx, t.CertPath, t.KeyPath, errs)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to load TLS certificate for interface %s: %w\", ifaceName, err)\n\t\t}\n\t\tgo func() {\n\t\t\tfor {\n\t\t\t\tselect {\n\t\t\t\tcase <-ctx.Done():\n\t\t\t\t\treturn\n\t\t\t\tcase err := <-errs:\n\t\t\t\t\tl.WithError(err).Error(\"Failed to reload TLS certificates, using previous certificates\")\n\t\t\t\t}\n\t\t\t}","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/configx/serve.go#L93-L129","documentation":"configx TLS.GetCertFunc wraps tlsx.CertificateFromBase64 failures with \"unable to load TLS certificate for interface %s: %w\". When both cert and key are supplied as base64 strings, they are decoded and parsed into an x509 certificate; any decode/parse failure is reported against the named interface.","triggerScenarios":"Configuring serve tls cert/key base64 values where the base64 is invalid, decodes to a malformed PEM, the cert is expired, or the key does not match the certificate.","commonSituations":"Base64-encoding the PEM file including newlines incorrectly, swapping cert and key values, truncating the base64 in YAML, using an ECDSA key path unsupported by the parser.","solutions":["Verify with: base64 -d < cert.b64 | openssl x509 -noout -text (and same for the key)","Re-encode the files: base64 -w0 cert.pem / base64 -w0 key.pem and paste fully","Ensure cert and key values are not swapped and correspond to each other","Regenerate the certificate if it fails parsing/expired"],"exampleFix":"# before\ntls:\n  cert_base64: <truncated>\n# after\ntls:\n  cert_base64: $(base64 -w0 cert.pem)\n  key_base64: $(base64 -w0 key.pem)","handlingStrategy":"validation","validationCode":"if _, err := base64.StdEncoding.DecodeString(certB64); err != nil {\n    return fmt.Errorf(\"invalid base64: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err != nil {\n    log.Fatalf(\"base64 TLS cert invalid: %v\", err)\n}","preventionTips":["Use base64 -w0 for encoding","Round-trip decode to verify before deploy","Keep cert/key pairs together and labeled"],"tags":["tls","configuration","base64"],"backgroundTag":"tls-certificate-load-failed","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}