{"record":{"id":"54a8d2cd3d3588d7","repo":"quickwit-oss/quickwit","slug":"no-certificate-found-in-cert-path","errorCode":null,"errorMessage":"no certificate found in `{cert_path}`","messagePattern":"no certificate found in `(.+?)`","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"quickwit/quickwit-transport/src/tls.rs","lineNumber":92,"sourceCode":"    rustls_pemfile::certs(&mut reader).collect()\n}\n\n/// Loads a single private key (PEM) from `filename`.\nfn load_private_key(filename: &str) -> io::Result<PrivateKeyDer<'static>> {\n    let keyfile = fs::File::open(filename)\n        .map_err(|error| io_error(format!(\"failed to open {filename}: {error}\")))?;\n    let mut reader = io::BufReader::new(keyfile);\n    let key_opt = rustls_pemfile::private_key(&mut reader)?;\n    key_opt.ok_or_else(|| io_error(format!(\"no private key found in {filename}\")))\n}\n\n/// Reads the certificate chain and private key from disk and assembles a [`CertifiedKey`] using the\n/// process-wide default crypto provider (ring, see\n/// `quickwit_cli::install_default_crypto_ring_provider`).\nfn load_certified_key(cert_path: &str, key_path: &str) -> anyhow::Result<CertifiedKey> {\n    let certs = load_certs(cert_path)?;\n    if certs.is_empty() {\n        anyhow::bail!(\"no certificate found in `{cert_path}`\");\n    }\n    let key = load_private_key(key_path)?;\n    let crypto_provider = rustls::crypto::CryptoProvider::get_default()\n        .context(\"no default rustls crypto provider is installed\")?;\n    let signing_key = crypto_provider\n        .key_provider\n        .load_private_key(key)\n        .with_context(|| format!(\"private key in `{key_path}` is not usable\"))?;\n    let certified_key = CertifiedKey::new(certs, signing_key);\n    // Guard against swapping in a mismatched cert/key pair, e.g. if the reload task reads the two\n    // files mid-rotation. A definite mismatch is fatal; an inconclusive result (key type that\n    // cannot expose its public key) is tolerated since we cannot do better.\n    match certified_key.keys_match() {\n        Ok(()) => {}\n        Err(rustls::Error::InconsistentKeys(rustls::InconsistentKeys::KeyMismatch)) => {\n            anyhow::bail!(\n                \"private key in `{key_path}` does not match certificate in `{cert_path}`\"\n            );","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/quickwit-oss/quickwit/blob/a39730c5cdcd1a4fe798403737ae293999ea21f8/quickwit/quickwit-transport/src/tls.rs#L74-L110","documentation":"When building a rustls CertifiedKey for TLS, `load_certified_key` parses the certificate chain file via `load_certs`. If the PEM parses successfully but yields zero certificates, it bails. This typically means the file exists but contains no cert blocks (empty file, key-only file, or wrong content).","triggerScenarios":"Configuring TLS with a `cert_path` pointing to an empty file, a file containing only a private key, or a file whose PEM blocks are not parseable certificates.","commonSituations":"Swapping cert and key paths in config; certificate rotation scripts writing an empty file temporarily; downloading a chain with no PEM content; mount failures leaving placeholder files.","solutions":["Ensure `cert_path` points to a PEM file with at least one `-----BEGIN CERTIFICATE-----` block.","Check that cert and key paths are not swapped in the TLS config.","Fix the deployment/rotation script so the cert file is never empty (write to temp file + atomic rename)."],"exampleFix":"// before\ncert_path: \"/etc/quickwit/tls/key.pem\"   // actually the key\nkey_path: \"/etc/quickwit/tls/cert.pem\"\n// after\ncert_path: \"/etc/quickwit/tls/cert.pem\"\nkey_path: \"/etc/quickwit/tls/key.pem\"","handlingStrategy":"validation","validationCode":"let certs = load_certs(&cert_path)?;\nif certs.is_empty() {\n    return Err(anyhow!(\"pre-check: {} has no certificates\", cert_path));\n}","typeGuard":null,"tryCatchPattern":"if let Err(e) = tls_config.load() {\n    if e.to_string().contains(\"no certificate found\") {\n        eprintln!(\"check cert_path content and cert/key ordering: {e}\");\n    }\n    return Err(e);\n}","preventionTips":["Never write empty cert files during rotation; use atomic rename.","Double-check cert vs key path ordering in configs.","Validate PEM contents in deployment scripts (grep for BEGIN CERTIFICATE)."],"tags":["tls","certificate","rustls"],"backgroundTag":"empty-required-field","analyzedSha":"a39730c5cdcd1a4fe798403737ae293999ea21f8","analyzedAt":"2026-09-08T13:19:37.784Z","contentChangedAt":"2026-09-08T13:19:37.784Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}