{"record":{"id":"2b7805d44470ebbf","repo":"locustio/locust","slug":"could-not-find-the-tls-certificate-file-invalid-p","errorCode":null,"errorMessage":"Could not find the TLS certificate file, invalid path: {conn.cert_file}","messagePattern":"Could not find the TLS certificate file, invalid path: (.+?)","errorType":"exception","errorClass":"OSError","httpStatus":null,"severity":"error","filePath":"locust/clients.py","lineNumber":524,"sourceCode":"\n                if not os.path.isdir(cert_loc):\n                    conn.ca_certs = cert_loc\n                else:\n                    conn.ca_cert_dir = cert_loc\n        else:\n            conn.cert_reqs = \"CERT_NONE\"\n            conn.ca_certs = None\n            conn.ca_cert_dir = None\n\n        if cert:\n            if not isinstance(cert, basestring):\n                conn.cert_file = cert[0]\n                conn.key_file = cert[1]\n            else:\n                conn.cert_file = cert\n                conn.key_file = None\n            if conn.cert_file and not os.path.exists(conn.cert_file):\n                raise OSError(f\"Could not find the TLS certificate file, invalid path: {conn.cert_file}\")\n            if conn.key_file and not os.path.exists(conn.key_file):\n                raise OSError(f\"Could not find the TLS key file, invalid path: {conn.key_file}\")\n\n    def build_connection_pool_key_attributes(self, request, verify, cert=None):\n        host_params, pool_kwargs = super().build_connection_pool_key_attributes(request, verify, cert)\n\n        if requests_version >= (2, 32, 5) and verify is True:\n            pool_kwargs[\"ssl_context\"] = _preloaded_ssl_context\n\n        return host_params, pool_kwargs\n\n\n# Monkey patch Response class to give some guidance\ndef _missing_catch_response_True(self, *_args, **_kwargs):\n    raise LocustError(\n        \"If you want to change the state of the request using .success() or .failure(), you must pass catch_response=True. See http://docs.locust.io/en/stable/writing-a-locustfile.html#validating-responses\"\n    )\n","sourceCodeStart":506,"sourceCodeEnd":542,"githubUrl":"https://github.com/locustio/locust/blob/f391a716e12c2c712e80b5835e877b7933397453/locust/clients.py#L506-L542","documentation":"When `cert` is given as a file path (or (cert, key) tuple), cert_verify assigns conn.cert_file and validates it exists on disk, raising OSError if not. The client cannot perform mutual TLS without the client certificate present.","triggerScenarios":"Passing `cert=\"/path/to/client.crt\"` or `cert=(crt, key)` to FastHttpSession requests where the certificate file path does not exist.","commonSituations":"mTLS setups where the client cert wasn't deployed to the load-generator; secrets not mounted in Docker/Kubernetes; relative path vs different CWD; permission-restricted paths.","solutions":["Check the cert path exists: `ls -l /path/to/client.crt`","Use absolute paths for cert (and key) files","Ensure secrets/certificates are mounted in containers and readable by the Locust process","Confirm tuple order is (cert, key) when passing a pair"],"exampleFix":"// before\nself.client.get(\"/\", cert=\"certs/client.pem\")  # relative, missing\n// after\nself.client.get(\"/\", cert=(\"/etc/locust/certs/client.crt\", \"/etc/locust/certs/client.key\"))","handlingStrategy":"validation","validationCode":"import os\ncert_path = \"/path/client.crt\"\nassert os.path.exists(cert_path), f\"client cert missing: {cert_path}\"","typeGuard":"def has_client_cert(cert):\n    paths = cert if isinstance(cert, (list, tuple)) else [cert]\n    return all(os.path.exists(p) for p in paths)","tryCatchPattern":"try:\n    client.get(url, cert=cert_pair)\nexcept OSError as e:\n    logger.error(\"cert invalid: %s\", e)","preventionTips":["Mount client certs as secrets with absolute paths","Check file readability permissions for the locust process","Validate cert/key presence at test start, not per-request"],"tags":["tls","ssl","client-certificate","mtls"],"backgroundTag":"tls-certificate-file-missing","analyzedSha":"f391a716e12c2c712e80b5835e877b7933397453","analyzedAt":"2026-08-29T00:36:13.872Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}