{"record":{"id":"83fbbc6542bbf88f","repo":"Netflix/chaosmonkey","slug":"cannot-use-both-p12-and-x509-certs-choose-one","errorCode":null,"errorMessage":"cannot use both p12 and x509 certs, choose one","messagePattern":"cannot use both p12 and x509 certs, choose one","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"spinnaker/spinnaker.go","lineNumber":145,"sourceCode":"\t\tpassword, err = decryptor.Decrypt(encryptedPassword)\n\t\tif err != nil {\n\t\t\treturn Spinnaker{}, err\n\t\t}\n\t}\n\n\treturn New(spinnakerEndpoint, certPath, password, x509Cert, x509Key, user)\n\n}\n\n// New returns a Spinnaker using a .p12 cert at certPath encrypted with\n// password or x509 cert. The user argument identifies the email address of the user which is\n// sent in the payload of the terminateInstances task API call\nfunc New(endpoint string, certPath string, password string, x509Cert string, x509Key string, user string) (Spinnaker, error) {\n\tvar client *http.Client\n\tvar err error\n\n\tif x509Cert != \"\" && certPath != \"\" {\n\t\treturn Spinnaker{}, errors.New(\"cannot use both p12 and x509 certs, choose one\")\n\t}\n\n\tif certPath != \"\" {\n\t\tpfxData, err := ioutil.ReadFile(certPath)\n\t\tif err != nil {\n\t\t\treturn Spinnaker{}, errors.Wrapf(err, \"failed to read file %s\", certPath)\n\t\t}\n\n\t\tclient, err = getClient(pfxData, password)\n\t\tif err != nil {\n\t\t\treturn Spinnaker{}, err\n\t\t}\n\t} else if x509Cert != \"\" {\n\t\tclient, err = getClientX509(x509Cert, x509Key)\n\t\tif err != nil {\n\t\t\treturn Spinnaker{}, err\n\t\t}\n\t} else {","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/Netflix/chaosmonkey/blob/eaa28fb761c0ebe8644d1333e5d164e9cc3071e9/spinnaker/spinnaker.go#L127-L163","documentation":"New() configures the Spinnaker client with TLS client authentication using either a PKCS#12 (.p12) cert file (certPath + password) or a PEM x509 cert/key pair (x509Cert + x509Key). This error is a config validation guard: both certPath and x509Cert were provided, which is ambiguous since the client can only use one auth mechanism.","triggerScenarios":"Calling New(endpoint, certPath, password, x509Cert, x509Key, user) with both certPath != \"\" and x509Cert != \"\". Via NewFromConfig, this happens when the chaosmonkey config file sets both the p12 certificate option (spinnaker.certificate) and the x509 options (spinnaker.x509Cert / x509Key).","commonSituations":"Migrating from p12 to x509 certs and leaving the old certificate entry in the config file; merging default and environment-specific config files that each specify a different cert style; copy-pasting example configs that use different auth styles.","solutions":["Remove the p12 certificate path (spinnaker.certificate) from your config if you intend to use x509Cert/x509Key","Remove the x509Cert/x509Key entries from your config if you intend to use the p12 cert with its password","Pass \"\" for either certPath or x509Cert when calling New() directly so exactly one auth mechanism is configured"],"exampleFix":"// before\nspinnaker:\n  endpoint: https://spinnaker.example.com\n  certificate: /etc/chaosmonkey/spinnaker.p12\n  x509Cert: /etc/chaosmonkey/client.crt\n  x509Key: /etc/chaosmonkey/client.key\n// after\nspinnaker:\n  endpoint: https://spinnaker.example.com\n  x509Cert: /etc/chaosmonkey/client.crt\n  x509Key: /etc/chaosmonkey/client.key","handlingStrategy":"validation","validationCode":"func validateCertConfig(certPath, x509Cert string) error {\n\tif certPath != \"\" && x509Cert != \"\" {\n\t\treturn fmt.Errorf(\"cannot use both p12 (%s) and x509 (%s) certs, choose one\", certPath, x509Cert)\n\t}\n\treturn nil\n}\n// call before spinnaker.New(...)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep exactly one TLS auth style in the chaosmonkey config; comment out the other","When migrating from p12 to x509, delete the old certificate entry in the same change","Add a startup config check that rejects both certificate styles","Document which cert style your Spinnaker endpoint requires"],"tags":["configuration","tls","certificates"],"backgroundTag":"conflicting-certificate-config","analyzedSha":"eaa28fb761c0ebe8644d1333e5d164e9cc3071e9","analyzedAt":"2026-09-03T17:04:39.020Z","contentChangedAt":"2026-09-03T17:04:39.020Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}