{"record":{"id":"3fdf1b92bb45b10b","repo":"hashicorp/terraform","slug":"can-not-read-leaf-private-key-from-s","errorCode":null,"errorMessage":"can not read leaf private key from %s","messagePattern":"can not read leaf private key from (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oci/auth.go","lineNumber":208,"sourceCode":"\n\t\tif p.region == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"unable to determine region from Terraform backend configuration while using Instance Principal with certificates\")\n\t\t}\n\n\t\tdefaultCertsDir, err := os.Getwd()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can not get working directory for current os platform\")\n\t\t}\n\n\t\tcertsDir := filepath.Clean(getEnvSettingWithDefault(\"test_certificates_location\", defaultCertsDir))\n\t\tleafCertificateBytes, err := getCertificateFileBytes(filepath.Join(certsDir, \"ip_cert.pem\"))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can not read leaf certificate from %s\", filepath.Join(certsDir, \"ip_cert.pem\"))\n\t\t}\n\n\t\tleafPrivateKeyBytes, err := getCertificateFileBytes(filepath.Join(certsDir, \"ip_key.pem\"))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can not read leaf private key from %s\", filepath.Join(certsDir, \"ip_key.pem\"))\n\t\t}\n\n\t\tleafPassphraseBytes := []byte{}\n\t\tif _, err := os.Stat(certsDir + \"/leaf_passphrase\"); !os.IsNotExist(err) {\n\t\t\tleafPassphraseBytes, err = getCertificateFileBytes(filepath.Join(certsDir + \"leaf_passphrase\"))\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"can not read leafPassphraseBytes from %s\", filepath.Join(certsDir+\"leaf_passphrase\"))\n\t\t\t}\n\t\t}\n\n\t\tintermediateCertificateBytes, err := getCertificateFileBytes(filepath.Join(certsDir, \"intermediate.pem\"))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can not read intermediate certificate from %s\", filepath.Join(certsDir, \"intermediate.pem\"))\n\t\t}\n\n\t\tintermediateCertificatesBytes := [][]byte{\n\t\t\tintermediateCertificateBytes,\n\t\t}","sourceCodeStart":190,"sourceCodeEnd":226,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/backend/remote-state/oci/auth.go#L190-L226","documentation":"Returned during InstancePrincipalWithCerts setup when getCertificateFileBytes fails to read the leaf private key file (ip_key.pem). This file must accompany ip_cert.pem in the certificates directory and is needed to establish the instance principal mTLS connection.","triggerScenarios":"auth=\"InstancePrincipalWithCerts\" is set and {certsDir}/ip_key.pem is missing, unreadable, or the directory is wrong.","commonSituations":"Test certificate set is incomplete (cert present but key missing); test_certificates_location points to wrong dir; file permission issue; certs generated on another machine and not fully copied.","solutions":["Ensure ip_key.pem exists alongside ip_cert.pem in the certs directory.","Set test_certificates_location to the directory containing the complete cert set (ip_cert.pem, ip_key.pem, intermediate.pem).","Regenerate the full test certificate bundle if the key is missing.","Verify read permissions on the file."],"exampleFix":"// before\n// certs dir has ip_cert.pem but not ip_key.pem\n\n// after\nexport test_certificates_location=/home/user/test-certs\n# ensure all files present:\nls $test_certificates_location/{ip_cert.pem,ip_key.pem,intermediate.pem}","handlingStrategy":"validation","validationCode":"func validateTestCerts(certsDir string) error {\n    files := []string{\"ip_cert.pem\", \"ip_key.pem\", \"intermediate.pem\"}\n    for _, f := range files {\n        if _, err := os.ReadFile(filepath.Join(certsDir, f)); err != nil {\n            return fmt.Errorf(\"cannot read %s: %w\", f, err)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Pre-validate before terraform init:\nif err := validateTestCerts(certsDir); err != nil {\n    log.Fatal(err)\n}","preventionTips":["Bundle all test certificates together — never partial sets.","Verify cert files are readable by the process before init.","Use a checksum or manifest to verify cert bundle completeness."],"tags":["oci","authentication","filesystem","certificates","instance-principal","private-key","terraform-backend"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}