{"record":{"id":"81766a9ca3a6377b","repo":"t8y2/dbx","slug":"hive-client-certificate-and-key-must-be-configured-81766a","errorCode":null,"errorMessage":"Hive client certificate and key must be configured together","messagePattern":"Hive client certificate and key must be configured together","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/hive-go/config.go","lineNumber":1088,"sourceCode":"\t\tcertificates, err := loadTrustStore(\n\t\t\ttrustStoreLocation,\n\t\t\tparameter(values, \"truststorepassword\"),\n\t\t\tparameter(values, \"truststoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive truststore: %w\", err)\n\t\t}\n\t\tif customRoots == nil {\n\t\t\tcustomRoots = x509.NewCertPool()\n\t\t}\n\t\tfor _, certificate := range certificates {\n\t\t\tcustomRoots.AddCert(certificate)\n\t\t}\n\t}\n\tconfig.RootCAs = customRoots\n\tif params.ClientCertPath != \"\" || params.ClientKeyPath != \"\" {\n\t\tif params.ClientCertPath == \"\" || params.ClientKeyPath == \"\" {\n\t\t\treturn nil, errors.New(\"Hive client certificate and key must be configured together\")\n\t\t}\n\t\tcertificate, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive client certificate: %w\", err)\n\t\t}\n\t\tconfig.Certificates = []tls.Certificate{certificate}\n\t}\n\tkeyStoreLocation := parameter(values, \"sslkeystore\")\n\tif keyStoreLocation != \"\" {\n\t\tif parameter(values, \"keystorepassword\") == \"\" && credentialProviderPath != \"\" {\n\t\t\treturn nil, errors.New(\"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent\")\n\t\t}\n\t\tcertificate, err := loadClientKeyStore(\n\t\t\tkeyStoreLocation,\n\t\t\tparameter(values, \"keystorepassword\"),\n\t\t\tparameter(values, \"keystoretype\"),\n\t\t)\n\t\tif err != nil {","sourceCodeStart":1070,"sourceCodeEnd":1106,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/hive-go/config.go#L1070-L1106","documentation":"Mutual TLS client authentication requires both a client certificate and its private key. If exactly one of ClientCertPath / ClientKeyPath is provided, the driver cannot assemble a usable tls.X509KeyPair and fails validation. This is a paired-parameter completeness check.","triggerScenarios":"Setting params.ClientCertPath without params.ClientKeyPath (or vice versa) before opening a connection with client-certificate TLS configured.","commonSituations":"Mounting only the cert in a container while the key is in a separate secret; typo in the key path variable; assuming the driver can fetch the key from a keystore or OS store when only cert path given.","solutions":["Provide both ClientCertPath and ClientKeyPath.","Verify secret mounts include both cert.pem and key.pem.","Combine cert+key into a single PEM and use a config form that accepts a combined file if supported."],"exampleFix":"// before\nparams.ClientCertPath = \"/etc/certs/client.pem\"\n// after\nparams.ClientCertPath = \"/etc/certs/client.pem\"\nparams.ClientKeyPath = \"/etc/certs/client.key\"","handlingStrategy":"validation","validationCode":"if (params.ClientCertPath == \"\") != (params.ClientKeyPath == \"\") {\n\treturn fmt.Errorf(\"client TLS requires both certificate and key\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always configure cert+key as a pair from the same secret/mount","Check secret mounts contain both files at startup","Use a config struct with a Validate() that enforces the pairing"],"tags":["tls","mutual-tls","config","certificates"],"backgroundTag":"client-cert-key-pair-incomplete","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}