{"record":{"id":"5e002816df9cf964","repo":"t8y2/dbx","slug":"load-neo4j-client-certificate-w","errorCode":null,"errorMessage":"load Neo4j client certificate: %w","messagePattern":"load Neo4j client certificate: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/neo4j-go/driver.go","lineNumber":96,"sourceCode":"\t\tif err != nil || roots == nil {\n\t\t\troots = x509.NewCertPool()\n\t\t}\n\t\tif !roots.AppendCertsFromPEM(certificate) {\n\t\t\treturn nil, errors.New(\"Neo4j CA certificate contains no valid PEM certificate\")\n\t\t}\n\t\ttlsConfig = &tls.Config{MinVersion: tls.VersionTLS12, RootCAs: roots}\n\t}\n\tvar clientCertificateProvider neo4jauth.ClientCertificateProvider\n\tif params.ClientCertPath != \"\" || params.ClientKeyPath != \"\" {\n\t\tif params.ClientCertPath == \"\" || params.ClientKeyPath == \"\" {\n\t\t\treturn nil, errors.New(\"both client certificate and client key are required\")\n\t\t}\n\t\tprovider, err := neo4jauth.NewStaticClientCertificateProvider(neo4jauth.ClientCertificate{\n\t\t\tCertFile: params.ClientCertPath,\n\t\t\tKeyFile:  params.ClientKeyPath,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Neo4j client certificate: %w\", err)\n\t\t}\n\t\tclientCertificateProvider = provider\n\t}\n\tif tlsConfig == nil && clientCertificateProvider == nil {\n\t\treturn nil, nil\n\t}\n\treturn func(driverConfig *config.Config) {\n\t\tif tlsConfig != nil {\n\t\t\tdriverConfig.TlsConfig = tlsConfig\n\t\t}\n\t\tif clientCertificateProvider != nil {\n\t\t\tdriverConfig.ClientCertificateProvider = clientCertificateProvider\n\t\t}\n\t}, nil\n}\n\nfunc buildNeo4jURI(params connectParams) (string, error) {\n\tif value := strings.TrimSpace(params.ConnectionString); value != \"\" {","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/neo4j-go/driver.go#L78-L114","documentation":"This error wraps any failure that occurs while loading the client certificate/key pair used for mutual TLS with a Neo4j server. neo4jTLSConfigurer calls neo4jauth.NewStaticClientCertificateProvider with the configured cert and key file paths; if either file is missing, unreadable, or the key does not match the certificate, the underlying error is wrapped with this message. It surfaces during driver creation (openDriver), so the driver never opens when it fires.","triggerScenarios":"Driver is configured with ClientCertPath/ClientKeyPath pointing to files that do not exist, are unreadable (permissions), contain malformed PEM data, or where the private key does not correspond to the certificate. The error is produced inside openDriver -> neo4jTLSConfigurer before any connection is attempted.","commonSituations":"Deployment mounts the cert volume at a different path than the driver config expects; running the agent as a non-root user without read permission on the key file; rotating certs and pointing only one of cert/key at the new files; using an encrypted key without supplying the passphrase.","solutions":["Verify both ClientCertPath and ClientKeyPath point to existing, readable files on the host running the driver","Confirm the key file matches the certificate (compare modulus/public key) and that both are valid PEM","Check file permissions so the agent process user can read the key (keys are often 0600 root-owned)","Regenerate or re-export the cert/key pair if the PEM data is malformed","Print the wrapped underlying error (%w) from the log to see the exact cause (e.g. open ...: no such file or directory)"],"exampleFix":"// before\nparams.ClientCertPath = \"certs/client.pem\" // relative path, wrong cwd\n// after\nparams.ClientCertPath = \"/etc/neo4j/tls/client.pem\"\nparams.ClientKeyPath  = \"/etc/neo4j/tls/client.key\" // absolute paths, verified readable","handlingStrategy":"validation","validationCode":"for _, p := range []string{params.ClientCertPath, params.ClientKeyPath} {\n    if fi, err := os.Stat(p); err != nil || fi.IsDir() {\n        return fmt.Errorf(\"tls file missing or unreadable: %s\", p)\n    }\n}\nif _, err := os.ReadFile(params.ClientKeyPath); err != nil {\n    return fmt.Errorf(\"key file not readable by this user: %w\", err)\n}","typeGuard":"func certFilesReadable(certPath, keyPath string) bool {\n    for _, p := range []string{certPath, keyPath} {\n        f, err := os.Open(p)\n        if err != nil { return false }\n        f.Close()\n    }\n    return true\n}","tryCatchPattern":null,"preventionTips":["Mount TLS files at fixed absolute paths and keep them in sync with config","Verify cert/key pairing after every rotation (compare public keys)","Grant the agent process user read access to the key file","Fail fast at startup with a config preflight that opens both files"],"tags":["neo4j","tls","certificate","configuration"],"backgroundTag":"tls-certificate-load-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}