{"record":{"id":"5038b4b48bf72f52","repo":"go-task/task","slug":"task-cert-and-cert-key-must-be-provided-toget","errorCode":null,"errorMessage":"task: --cert and --cert-key must be provided together","messagePattern":"task: --cert and --cert-key must be provided together","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/flags/flags.go","lineNumber":246,"sourceCode":"\tif List && ListAll {\n\t\treturn errors.New(\"task: cannot use --list and --list-all at the same time\")\n\t}\n\n\tif ListJson && !List && !ListAll {\n\t\treturn errors.New(\"task: --json only applies to --list or --list-all\")\n\t}\n\n\tif NoStatus && !ListJson {\n\t\treturn errors.New(\"task: --no-status only applies to --json with --list or --list-all\")\n\t}\n\n\tif Nested && !ListJson {\n\t\treturn errors.New(\"task: --nested only applies to --json with --list or --list-all\")\n\t}\n\n\t// Validate certificate flags\n\tif (Cert != \"\" && CertKey == \"\") || (Cert == \"\" && CertKey != \"\") {\n\t\treturn errors.New(\"task: --cert and --cert-key must be provided together\")\n\t}\n\n\treturn nil\n}\n\n// WithFlags is a special internal functional option that is used to pass flags\n// from the CLI into any constructor that accepts functional options.\nfunc WithFlags() task.ExecutorOption {\n\treturn &flagsOption{}\n}\n\ntype flagsOption struct{}\n\nfunc (o *flagsOption) ApplyToExecutor(e *task.Executor) {\n\t// Set the sorter\n\tvar sorter sort.Sorter\n\tswitch TaskSort {\n\tcase \"none\":","sourceCodeStart":228,"sourceCodeEnd":264,"githubUrl":"https://github.com/go-task/task/blob/385e5ad92af02877b6d7cf9dcc963b5ed916e70a/internal/flags/flags.go#L228-L264","documentation":"Validate in internal/flags requires mutual TLS credentials to be supplied as a pair. --cert without --cert-key, or vice versa, is rejected because a TLS client config cannot be built from a half-specified certificate/key set.","triggerScenarios":"Passing only --cert, or only --cert-key, to the task binary (or setting Cert/CertKey fields inconsistently via WithFlags).","commonSituations":"Users configuring remote Task (TLS) copy a server cert path but forget the private key, or an env/secret substitution leaves one of the two values empty.","solutions":["Provide both flags together: --cert <certfile> --cert-key <keyfile>","Check that neither value is empty after variable/env expansion","Remove both flags if TLS client auth is not needed"],"exampleFix":"// before\ntask --cert ./client.crt\n// after\ntask --cert ./client.crt --cert-key ./client.key","handlingStrategy":"validation","validationCode":"if (cert != \"\") != (certKey != \"\") {\n    return fmt.Errorf(\"--cert and --cert-key must be provided together\")\n}","typeGuard":"func certPairComplete(cert, certKey string) bool {\n    return (cert == \"\") == (certKey == \"\")\n}","tryCatchPattern":null,"preventionTips":["Always pass --cert and --cert-key from the same config block","Expand env vars first and fail fast if one resolves empty","Store cert/key paths together (e.g. one struct) so they can't diverge"],"tags":["cli","flag-validation","tls"],"backgroundTag":"incomplete-tls-credentials","analyzedSha":"385e5ad92af02877b6d7cf9dcc963b5ed916e70a","analyzedAt":"2026-09-05T09:01:05.226Z","contentChangedAt":"2026-09-05T09:01:05.226Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}