{"record":{"id":"28901b999fd5aa99","repo":"BerriAI/litellm","slug":"could-not-authenticate-to-vault-via-tls-cert-e","errorCode":null,"errorMessage":"Could not authenticate to Vault via TLS cert: {e}","messagePattern":"Could not authenticate to Vault via TLS cert: (.+?)","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"litellm/secret_managers/hashicorp_secret_manager.py","lineNumber":200,"sourceCode":"        headers: Final = {}\n        if hasattr(self, \"vault_namespace\") and self.vault_namespace:\n            headers[\"X-Vault-Namespace\"] = self.vault_namespace\n        try:\n            # We use the client cert and key for mutual TLS\n            client: Final = httpx.Client(cert=(self.tls_cert_path, self.tls_key_path))\n            resp: Final = client.post(\n                login_url,\n                headers=headers,\n                json=self._get_tls_cert_auth_body(),\n            )\n            resp.raise_for_status()\n            token: Final = resp.json()[\"auth\"][\"client_token\"]\n            _lease_duration: Final = resp.json()[\"auth\"][\"lease_duration\"]\n            verbose_logger.debug(\"Successfully obtained Vault token via TLS cert auth.\")\n            self.cache.set_cache(key=\"hcp_vault_token\", value=token, ttl=_lease_duration)\n            return token\n        except Exception as e:\n            raise RuntimeError(f\"Could not authenticate to Vault via TLS cert: {e}\")\n\n    def _get_tls_cert_auth_body(self) -> dict:\n        return {\"name\": self.vault_cert_role}\n\n    def get_url(\n        self,\n        secret_name: str,\n        namespace: str | None = None,\n        mount_name: str | None = None,\n        path_prefix: str | None = None,\n    ) -> str:\n        \"\"\"\n        Constructs the Vault URL for KV v2 secrets.\n\n        Format: {VAULT_ADDR}/v1/{NAMESPACE}/{MOUNT_NAME}/data/{PATH_PREFIX}/{SECRET_NAME}\n\n        Examples:\n        - Default: http://127.0.0.1:8200/v1/secret/data/mykey","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/secret_managers/hashicorp_secret_manager.py#L182-L218","documentation":"TLS certificate authentication failure for Vault: the mutual-TLS login request using the configured client cert/key (HCP_VAULT_CLIENT_CERT/KEY) failed — bad certificate files, wrong role, or an HTTP error — so no Vault token was returned.","triggerScenarios":"Thrown at litellm/secret_managers/hashicorp_secret_manager.py:200 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check HCP_VAULT_CLIENT_CERT/HCP_VAULT_CLIENT_KEY point to valid, unexpired cert and key files.","Inspect {e}; ensure the cert auth role is configured in Vault for this certificate."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}