{"record":{"id":"6cb44264a4ab52f8","repo":"t8y2/dbx","slug":"load-hive-client-certificate-w-6cb442","errorCode":null,"errorMessage":"load Hive client certificate: %w","messagePattern":"load Hive client certificate: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":1092,"sourceCode":"\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive truststore: %w\", err)\n\t\t}\n\t\tif customRoots == nil {\n\t\t\tcustomRoots = x509.NewCertPool()\n\t\t}\n\t\tfor _, certificate := range certificates {\n\t\t\tcustomRoots.AddCert(certificate)\n\t\t}\n\t}\n\tconfig.RootCAs = customRoots\n\tif params.ClientCertPath != \"\" || params.ClientKeyPath != \"\" {\n\t\tif params.ClientCertPath == \"\" || params.ClientKeyPath == \"\" {\n\t\t\treturn nil, errors.New(\"Hive client certificate and key must be configured together\")\n\t\t}\n\t\tcertificate, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive client certificate: %w\", err)\n\t\t}\n\t\tconfig.Certificates = []tls.Certificate{certificate}\n\t}\n\tkeyStoreLocation := parameter(values, \"sslkeystore\")\n\tif keyStoreLocation != \"\" {\n\t\tif parameter(values, \"keystorepassword\") == \"\" && credentialProviderPath != \"\" {\n\t\t\treturn nil, errors.New(\"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent\")\n\t\t}\n\t\tcertificate, err := loadClientKeyStore(\n\t\t\tkeyStoreLocation,\n\t\t\tparameter(values, \"keystorepassword\"),\n\t\t\tparameter(values, \"keystoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive keystore: %w\", err)\n\t\t}\n\t\tconfig.Certificates = append(config.Certificates, certificate)\n\t}","sourceCodeStart":1074,"sourceCodeEnd":1110,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L1074-L1110","documentation":"This error wraps tls.LoadX509KeyPair failures when loading the client certificate and private key for mutual TLS with HiveServer2 (config.go:1092). It fires when clientcert/clientkey paths are both configured but the pair cannot be loaded — unreadable files, bad PEM encoding, or a key that does not match the certificate.","triggerScenarios":"Both params.ClientCertPath and params.ClientKeyPath are set, and tls.LoadX509KeyPair(certPath, keyPath) fails: file missing/unreadable, invalid PEM, encrypted key without decryption support, or cert/key mismatch.","commonSituations":"mTLS setup where the client cert and key were rotated out of sync; key file has a passphrase the driver cannot prompt for; copying only the cert into a container but not the key; concatenated wrong cert/key pair.","solutions":["Verify both the client cert and key files exist and are readable by the process.","Confirm the certificate and key are a matching pair (compare modulus/public key).","Ensure the key PEM is unencrypted or re-export it without a passphrase.","Regenerate or re-download the client certificate pair if the PEM is malformed."],"exampleFix":"// before\nconfig.Certificates, err = tls.LoadX509KeyPair(\"client.crt\", \"old-client.key\")\n// after\nconfig.Certificates, err = tls.LoadX509KeyPair(\"/etc/hive/client.crt\", \"/etc/hive/client.key\")","handlingStrategy":"validation","validationCode":"if params.ClientCertPath != \"\" || params.ClientKeyPath != \"\" {\n    if params.ClientCertPath == \"\" || params.ClientKeyPath == \"\" {\n        return errors.New(\"client cert and key must both be set\")\n    }\n    for _, p := range []string{params.ClientCertPath, params.ClientKeyPath} {\n        if _, err := os.Stat(p); err != nil {\n            return fmt.Errorf(\"mTLS file not accessible: %s\", p)\n        }\n    }\n}\n","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always configure cert and key as a matched pair from the same issuance.","Strip passphrases from keys used by non-interactive services.","Verify cert/key pairing with openssl x509 / openssl rsa modulus comparison before deploying.","Rotate cert and key together and smoke-test the connection after rotation."],"tags":["tls","mtls","client-certificate","go"],"backgroundTag":"tls-key-pair-load-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}