{"record":{"id":"2113f5e7dc6f6df5","repo":"hashicorp/terraform","slug":"cannot-load-client-certificate-w","errorCode":null,"errorMessage":"cannot load client certificate: %w","messagePattern":"cannot load client certificate: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/http/backend.go","lineNumber":301,"sourceCode":"\tvar tlsConfig tls.Config\n\tclient.HTTPClient.Transport.(*http.Transport).TLSClientConfig = &tlsConfig\n\n\tif skipCertVerification {\n\t\t// ignores TLS verification\n\t\ttlsConfig.InsecureSkipVerify = true\n\t}\n\tif clientCACertificatePem != \"\" {\n\t\t// trust servers based on a CA\n\t\ttlsConfig.RootCAs = x509.NewCertPool()\n\t\tif !tlsConfig.RootCAs.AppendCertsFromPEM([]byte(clientCACertificatePem)) {\n\t\t\treturn errors.New(\"failed to append certs\")\n\t\t}\n\t}\n\tif clientCertificatePem != \"\" && clientPrivateKeyPem != \"\" {\n\t\t// attach a client certificate to the TLS handshake (aka mTLS)\n\t\tcertificate, err := tls.X509KeyPair([]byte(clientCertificatePem), []byte(clientPrivateKeyPem))\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"cannot load client certificate: %w\", err)\n\t\t}\n\t\ttlsConfig.Certificates = []tls.Certificate{certificate}\n\t}\n\n\treturn nil\n}\n\nfunc (b *Backend) StateMgr(name string) (statemgr.Full, tfdiags.Diagnostics) {\n\tvar diags tfdiags.Diagnostics\n\n\tif name != backend.DefaultStateName {\n\t\treturn nil, diags.Append(backend.ErrWorkspacesNotSupported)\n\t}\n\n\tsm := &remote.State{Client: b.client}\n\n\tif err := sm.RefreshState(); err != nil {\n\t\treturn nil, diags.Append(err)","sourceCodeStart":283,"sourceCodeEnd":319,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/http/backend.go#L283-L319","documentation":"tls.X509KeyPair could not build a certificate from the supplied client_certificate_pem + client_private_key_pem pair. The '%w' wraps the crypto/tls error, commonly 'tls: failed to find any PEM data in certificate input', 'tls: failed to find certificate PEM data', or a key/cert mismatch. Fires at Configure time, after the pair-presence check.","triggerScenarios":"Either PEM value is not actually PEM (base64 of a DER blob, a JSON file, a header comment, truncated output); the key and cert do not correspond; wrong key type (e.g. an EC cert with an RSA key); a stray newline or BOM in the file content.","commonSituations":"file() reads a path that contains the cert in DER not PEM; secret was base64-encoded twice by the vault shim; copy-paste dropped the BEGIN/END markers; cert/key rotated and out of sync.","solutions":["Verify both files contain PEM armor: lines beginning with -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- (and the corresponding PRIVATE KEY----- markers).","Re-derive from source with `openssl x509 -in client.crt -inform PEM -noout` (exit 0 = valid PEM cert) and `openssl pkey -in client.key -inform PEM -noout`.","Confirm the key matches the cert: `openssl x509 -in client.crt -noout -modulus | openssl md5` vs the equivalent for the key (RSA), or use `openssl x509 -noout -pubkey`/`openssl pkey -pubout` comparison for general keys.","If loading from a secret store, decode any base64 wrapping exactly once."],"exampleFix":"// before (DER cert fed as PEM)\nclient_certificate_pem = file(\"client.der\")\n// after\nclient_certificate_pem = file(\"client.pem\")\n// generate with: openssl x509 -in client.der -inform DER -out client.pem -outform PEM","handlingStrategy":"validation","validationCode":"import (\n  \"crypto/tls\"\n  \"fmt\"\n)\nfunc validateKeyPair(certPEM, keyPEM []byte) error {\n  if _, err := tls.X509KeyPair(certPEM, keyPEM); err != nil {\n    return fmt.Errorf(\"client cert/key invalid: %w\", err)\n  }\n  return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run `openssl x509 -in cert -noout` and `openssl pkey -in key -noout` in CI before deploy.","Store PEM (not DER) in secrets; decode base64 exactly once.","Add a pre-terraform step that calls tls.X509KeyPair on the configured values."],"tags":["tls","mtls","pem-parsing","config","http-backend"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}