{"record":{"id":"6fd4989b509feb30","repo":"nautechsystems/nautilus_trader","slug":"client-certificate-or-private-key-missing-in-bu","errorCode":null,"errorMessage":"Client certificate or private key missing in {} but client auth required","messagePattern":"Client certificate or private key missing in (.+?) but client auth required","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/network/src/tls.rs","lineNumber":175,"sourceCode":"        None\n    };\n\n    for (path, certs) in all_certs {\n        for cert in certs {\n            if let Err(e) = root_store.add(cert) {\n                log::warn!(\"Invalid certificate in {}: {e}\", path.display());\n            }\n        }\n    }\n\n    let builder = rustls::ClientConfig::builder().with_root_certificates(root_store);\n\n    if let (Some(cert), Some(key)) = (client_cert, client_key) {\n        return Ok(builder.with_client_auth_cert(cert, key)?);\n    }\n\n    if require_client_auth {\n        anyhow::bail!(\n            \"Client certificate or private key missing in {} but client auth required\",\n            certs_dir.display(),\n        );\n    }\n\n    log::debug!(\n        \"No TLS client certificate/key pair found in {}; proceeding without client authentication\",\n        certs_dir.display(),\n    );\n\n    Ok(builder.with_no_client_auth())\n}\n\nfn load_private_key(path: &Path) -> anyhow::Result<PrivateKeyDer<'static>> {\n    let file = File::open(path)?;\n    if let Some(key) = PrivatePkcs8KeyDer::pem_reader_iter(file).find_map(Result::ok) {\n        return Ok(key.into());\n    }","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/network/src/tls.rs#L157-L193","documentation":"When building the TLS client config from a certs directory, if the directory contains a CA but no client certificate + private key pair, and require_client_auth is true, the function bails: mutual TLS cannot proceed without a client identity.","triggerScenarios":"connect_url with client-auth-required TLS against a certs directory that has only the CA (or only one of cert/key present), while the server demands client certificates.","commonSituations":"Server configured with client auth (mutual TLS) but client cert directory only contains the server CA; cert and key files named unexpectedly so the loader doesn't recognize them; partial secret mount missing client.pem or client.key.","solutions":["Place both the client certificate and its private key PEM files in the certs directory.","Check the server's mTLS requirement: if client auth is not actually required, disable require_client_auth.","Verify the loader recognizes your file names/formats (PEM); confirm both cert and key are found by listing the directory contents.","Ensure secret-manager mounts include both client cert and key files."],"exampleFix":"// before\n/etc/certs/ca.pem                  # only CA, server requires mTLS\n// after\n/etc/certs/ca.pem\n/etc/certs/client.pem              # client certificate\n/etc/certs/client.key              # client private key","handlingStrategy":"validation","validationCode":"// Rust: ensure client cert+key exist when mTLS required\nlet dir = std::path::Path::new(certs_dir);\nlet has_cert = dir.read_dir()?.flatten().any(|e| e.path().extension().map_or(false, |x| x == \"pem\"));\nif require_client_auth && !has_cert {\n    return Err(anyhow::anyhow!(\"mTLS requires client cert+key in {}\", certs_dir.display()));\n}","typeGuard":null,"tryCatchPattern":"let tls_cfg = create_tls_config_from_certs_dir(certs_dir, require_client_auth)\n    .map_err(|e| { log::error!(\"mtls setup failed: {e}\"); e })?;","preventionTips":["Provision both client certificate and private key in the certs directory.","Confirm whether the server actually requires client auth before enabling the flag.","Standardize PEM file naming so the loader finds cert and key.","Audit secret mounts to confirm both files are present."],"tags":["rust","tls","mtls","certificate","config"],"backgroundTag":"missing-credentials","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}