{"record":{"id":"75e0c5064ff19a0e","repo":"microsoft/playwright","slug":"key-is-specified-without-cert","errorCode":null,"errorMessage":"key is specified without cert","messagePattern":"key is specified without cert","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/playwright-core/src/server/browserContext.ts","lineNumber":806,"sourceCode":"    throw new Error(`geolocation.longitude: precondition -180 <= LONGITUDE <= 180 failed.`);\n  if (latitude < -90 || latitude > 90)\n    throw new Error(`geolocation.latitude: precondition -90 <= LATITUDE <= 90 failed.`);\n  if (accuracy < 0)\n    throw new Error(`geolocation.accuracy: precondition 0 <= ACCURACY failed.`);\n}\n\nexport function verifyClientCertificates(clientCertificates?: types.BrowserContextOptions['clientCertificates']) {\n  if (!clientCertificates)\n    return;\n  for (const cert of clientCertificates) {\n    if (!cert.origin)\n      throw new Error(`clientCertificates.origin is required`);\n    if (!cert.cert && !cert.key && !cert.passphrase && !cert.pfx)\n      throw new Error('None of cert, key, passphrase or pfx is specified');\n    if (cert.cert && !cert.key)\n      throw new Error('cert is specified without key');\n    if (!cert.cert && cert.key)\n      throw new Error('key is specified without cert');\n    if (cert.pfx && (cert.cert || cert.key))\n      throw new Error('pfx is specified together with cert, key or passphrase');\n  }\n}\n\nexport function normalizeProxySettings(proxy: types.ProxySettings): types.ProxySettings {\n  let { server, bypass } = proxy;\n  let url;\n  try {\n    // new URL('127.0.0.1:8080') throws\n    // new URL('localhost:8080') fails to parse host or protocol\n    // In both of these cases, we need to try re-parse URL with `http://` prefix.\n    url = new URL(server);\n    if (!url.host || !url.protocol)\n      url = new URL('http://' + server);\n  } catch (e) {\n    url = new URL('http://' + server);\n  }","sourceCodeStart":788,"sourceCodeEnd":824,"githubUrl":"https://github.com/microsoft/playwright/blob/c8fc3bf8d31542d59b4d4d9eaab1df93ff541dc6/packages/playwright-core/src/server/browserContext.ts#L788-L824","documentation":"Thrown by verifyClientCertificates() when a clientCertificates entry has key set but cert is falsy. A private key without its matching certificate cannot be used for TLS client auth, so Playwright rejects the entry before constructing a secure context.","triggerScenarios":"browser.newContext({ clientCertificates: [{ origin, key: <Buffer> /* cert missing */ }] }), or the same via APIRequestContext.newContext / launchPersistentContext.","commonSituations":"Developer loads the .key file but forgets the .crt, or certPath resolves to undefined because the file does not exist.","solutions":["Provide cert alongside key (cert: fs.readFileSync('client.crt') or a valid certPath).","If only a PKCS12 bundle is available, switch to pfx and remove the key field.","Verify certPath is an existing, readable file so its Buffer is populated before validation."],"exampleFix":"// before\nclientCertificates: [{ origin, key: fs.readFileSync('client.key') }]\n// after\nclientCertificates: [{ origin, cert: fs.readFileSync('client.crt'), key: fs.readFileSync('client.key') }]","handlingStrategy":"validation","validationCode":"function validateCertKeyPair(certs?: ClientCertificate[]) {\n  for (const c of certs || []) {\n    if (!c.cert && c.key) throw new Error(`key set without cert for ${c.origin}`);\n  }\n}","typeGuard":"function isCompleteCertKeyPair(c: ClientCertificate): boolean {\n  return (!!c.cert && !!c.key) || (!c.cert && !c.key);\n}","tryCatchPattern":null,"preventionTips":["Keep cert and key paths together in configuration so one is never supplied alone.","Validate certPath/keyPath resolve to readable files before passing them through."],"tags":["client-certificates","tls","validation"],"backgroundTag":null,"analyzedSha":"c8fc3bf8d31542d59b4d4d9eaab1df93ff541dc6","analyzedAt":"2026-08-12T07:26:36.950Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}