{"record":{"id":"88dc781627466e52","repo":"t8y2/dbx","slug":"load-hive-client-certificate-w","errorCode":null,"errorMessage":"load Hive client certificate: %w","messagePattern":"load Hive client certificate: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":1089,"sourceCode":"\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive truststore: %w\", err)\n\t\t}\n\t\tif customRoots == nil {\n\t\t\tcustomRoots = x509.NewCertPool()\n\t\t}\n\t\tfor _, certificate := range certificates {\n\t\t\tcustomRoots.AddCert(certificate)\n\t\t}\n\t}\n\tconfig.RootCAs = customRoots\n\tif params.ClientCertPath != \"\" || params.ClientKeyPath != \"\" {\n\t\tif params.ClientCertPath == \"\" || params.ClientKeyPath == \"\" {\n\t\t\treturn nil, errors.New(\"Hive client certificate and key must be configured together\")\n\t\t}\n\t\tcertificate, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive client certificate: %w\", err)\n\t\t}\n\t\tconfig.Certificates = []tls.Certificate{certificate}\n\t}\n\tkeyStoreLocation := parameter(values, \"sslkeystore\")\n\tif keyStoreLocation != \"\" {\n\t\tif parameter(values, \"keystorepassword\") == \"\" && credentialProviderPath != \"\" {\n\t\t\treturn nil, errors.New(\"Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent\")\n\t\t}\n\t\tcertificate, err := loadClientKeyStore(\n\t\t\tkeyStoreLocation,\n\t\t\tparameter(values, \"keystorepassword\"),\n\t\t\tparameter(values, \"keystoretype\"),\n\t\t)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Hive keystore: %w\", err)\n\t\t}\n\t\tconfig.Certificates = append(config.Certificates, certificate)\n\t}","sourceCodeStart":1071,"sourceCodeEnd":1107,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L1071-L1107","documentation":"The driver loads a mutual-TLS client identity with tls.LoadX509KeyPair when clientCertPath/clientKeyPath are set, wrapping any failure with this message. LoadX509KeyPair fails on unreadable files, malformed PEM, or cert/key mismatch. It is thrown because mTLS cannot proceed without a usable certificate/key pair.","triggerScenarios":"Opening a Hive connection with a client certificate and/or key path configured where tls.LoadX509KeyPair fails: missing file, invalid PEM, encrypted key with wrong/missing password, or certificate and key that don't match (or only one of the two paths set — that raises the 'configured together' error instead).","commonSituations":"Cert renewed but key not updated (or vice versa) causing mismatch; PEM encoding wrong (DER certificate supplied); key file permissions too restrictive for the service account; cert/key paths swapped in config.","solutions":["Check the wrapped cause: verify both cert and key files exist and are readable","Confirm the certificate and key are a matching pair (compare modulus/public key)","Ensure both files are PEM-encoded; convert DER to PEM if needed","Swap cert/key paths if accidentally reversed in the config"],"exampleFix":"// before\nopenssl x509 -in cert.pem -noout -modulus | md5sum; md5sum key.pem  # mismatch\n// after\nopenssl rsa -in key.pem -out key.pem  # re-export matching key, redeploy both files","handlingStrategy":"validation","validationCode":"if (params.ClientCertPath == \"\") != (params.ClientKeyPath == \"\") {\n    return errors.New(\"client cert and key must both be set\")\n}\nif params.ClientCertPath != \"\" {\n    if _, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath); err != nil {\n        return fmt.Errorf(\"invalid client cert/key pair: %w\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := db.PingContext(ctx); err != nil {\n    if strings.HasPrefix(err.Error(), \"load Hive client certificate:\") {\n        log.Fatalf(\"mTLS identity invalid, check cert/key pair: %v\", err)\n    }\n    return err\n}","preventionTips":["Pre-validate cert/key pairs with tls.LoadX509KeyPair at startup","Rotate cert and key together; verify pairing via public key comparison","Ensure PEM encoding for both files","Restrict key file permissions to the service user"],"tags":["tls","hive","mtls","config"],"backgroundTag":"tls-certificate-load-failed","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}