{"record":{"id":"a25a08625106a7ff","repo":"probelabs/goreplay","slug":"missing-key-of-client-certificate-in-kafka","errorCode":null,"errorMessage":"Missing key of client certificate in kafka","messagePattern":"Missing key of client certificate in kafka","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kafka.go","lineNumber":71,"sourceCode":"\n// KafkaMessage should contains catched request information that should be\n// passed as Json to Apache Kafka.\ntype KafkaMessage struct {\n\tReqURL     string            `json:\"Req_URL\"`\n\tReqType    string            `json:\"Req_Type\"`\n\tReqID      string            `json:\"Req_ID\"`\n\tReqTs      string            `json:\"Req_Ts\"`\n\tReqMethod  string            `json:\"Req_Method\"`\n\tReqBody    string            `json:\"Req_Body,omitempty\"`\n\tReqHeaders map[string]string `json:\"Req_Headers,omitempty\"`\n}\n\n// NewTLSConfig loads TLS certificates\nfunc NewTLSConfig(clientCertFile, clientKeyFile, caCertFile string) (*tls.Config, error) {\n\ttlsConfig := tls.Config{}\n\n\tif clientCertFile != \"\" && clientKeyFile == \"\" {\n\t\treturn &tlsConfig, errors.New(\"Missing key of client certificate in kafka\")\n\t}\n\tif clientCertFile == \"\" && clientKeyFile != \"\" {\n\t\treturn &tlsConfig, errors.New(\"missing TLS client certificate in kafka\")\n\t}\n\t// Load client cert\n\tif (clientCertFile != \"\") && (clientKeyFile != \"\") {\n\t\tcert, err := tls.LoadX509KeyPair(clientCertFile, clientKeyFile)\n\t\tif err != nil {\n\t\t\treturn &tlsConfig, err\n\t\t}\n\t\ttlsConfig.Certificates = []tls.Certificate{cert}\n\t}\n\t// Load CA cert\n\tif caCertFile != \"\" {\n\t\tcaCert, err := ioutil.ReadFile(caCertFile)\n\t\tif err != nil {\n\t\t\treturn &tlsConfig, err\n\t\t}","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/probelabs/goreplay/blob/251e45abd242886bb64ff2b2dc98789556b56330/kafka.go#L53-L89","documentation":"NewTLSConfig rejects Kafka TLS setup when a client certificate file is given without its corresponding private key file: the pair is incomplete and tls.LoadX509KeyPair could never succeed, so it fails early with this error.","triggerScenarios":"Thrown at kafka.go:71 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Pass both client cert and key, e.g. --kafka TLS client-cert and client-key flags together","Omit the client cert entirely if mutual TLS is not required","Check config templating — the key file variable may be resolving to empty"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"251e45abd242886bb64ff2b2dc98789556b56330","analyzedAt":"2026-09-02T16:44:11.369Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T21:17:11.164Z"}