{"record":{"id":"6daff030cdd375dd","repo":"projectdiscovery/nuclei","slug":"if-a-client-certification-option-is-provided-then","errorCode":null,"errorMessage":"if a client certification option is provided, then all three must be provided","messagePattern":"if a client certification option is provided, then all three must be provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/runner/options.go","lineNumber":185,"sourceCode":"\t\treturn errors.New(\"both follow redirects and disable redirects specified\")\n\t}\n\t// loading the proxy server list from file or cli and test the connectivity\n\tif err := loadProxyServers(options); err != nil {\n\t\treturn err\n\t}\n\tif options.Validate {\n\t\tvalidateTemplatePaths(options.Logger, config.DefaultConfig.TemplatesDirectory, options.Templates, options.Workflows)\n\t}\n\tif options.DAST {\n\t\tif err := validateDASTOptions(options); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\t// Verify if any of the client certificate options were set since it requires all three to work properly\n\tif options.HasClientCertificates() {\n\t\tif generic.EqualsAny(\"\", options.ClientCertFile, options.ClientKeyFile, options.ClientCAFile) {\n\t\t\treturn errors.New(\"if a client certification option is provided, then all three must be provided\")\n\t\t}\n\t\tvalidateCertificatePaths(options.Logger, options.ClientCertFile, options.ClientKeyFile, options.ClientCAFile)\n\t}\n\t// Verify AWS secrets are passed if a S3 template bucket is passed\n\tif options.AwsBucketName != \"\" && options.UpdateTemplates && !options.AwsTemplateDisableDownload {\n\t\tmissing := validateMissingS3Options(options)\n\t\tif missing != nil {\n\t\t\treturn fmt.Errorf(\"aws s3 bucket details are missing. Please provide %s\", strings.Join(missing, \",\"))\n\t\t}\n\t}\n\n\t// Verify Azure connection configuration is passed if the Azure template bucket is passed\n\tif options.AzureContainerName != \"\" && options.UpdateTemplates && !options.AzureTemplateDisableDownload {\n\t\tmissing := validateMissingAzureOptions(options)\n\t\tif missing != nil {\n\t\t\treturn fmt.Errorf(\"azure connection details are missing. Please provide %s\", strings.Join(missing, \",\"))\n\t\t}\n\t}","sourceCodeStart":167,"sourceCodeEnd":203,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/internal/runner/options.go#L167-L203","documentation":"ReplaceInteractshMarkers asks the configured interactsh client (source.NewURLWithData) to mint an OAST URL for every interactsh marker found in template text. If the client cannot allocate one - server unreachable, error response, or client stopped - value rendering fails with this wrapped error, across every protocol that prepares template values.","triggerScenarios":"A template containing {{interactsh-url}} style markers while the OAST server (default public instance or the -interactsh-server target) is unreachable, rate-limits, or errors during URL registration.","commonSituations":"Corporate egress blocking OAST domains; a self-hosted interactsh server that is down; transient public-server outages during large scans.","solutions":["Verify the OAST server is reachable (curl / DNS check) from the scanning host","Retry the scan - allocation failures are frequently transient","Point -interactsh-server at a healthy or self-hosted instance","If out-of-band detection is not needed, disable it with -no-interactsh"],"exampleFix":"# before\nnuclei -t tpl.yaml   # default OAST endpoint failing\n# after\nnuclei -t tpl.yaml -interactsh-server https://oast.mycorp.com","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"result, err := render.ReplaceInteractshMarkers(text, src, urls)\nif err != nil && strings.Contains(err.Error(), \"replace interactsh marker\") {\n    // OAST allocation failure: back off once, then surface\n    time.Sleep(2 * time.Second)\n    result, err = render.ReplaceInteractshMarkers(text, src, urls)\n}\nif err != nil {\n    return err\n}","preventionTips":["Health-check the OAST server before large scans","Self-host interactsh for reliability","Disable OOB (-no-interactsh) for templates without markers"],"tags":["interactsh","oast","network","template"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}