{"record":{"id":"a3f6ddf3c5c1e464","repo":"temporalio/temporal","slug":"client-auth-required-but-no-certificate-provided","errorCode":null,"errorMessage":"client auth required, but no certificate provided","messagePattern":"client auth required, but no certificate provided","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/rpc/encryption/local_store_tls_provider.go","lineNumber":390,"sourceCode":") (*tls.Config, error) {\n\t// Optional ServerCA for client if not already trusted by host\n\tserverCa, err := clientProvider.FetchServerRootCAsForClient(isWorker)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to load client ca: %v\", err)\n\t}\n\n\tvar getCert tlsCertFetcher\n\n\t// mTLS enabled, present certificate\n\tif isAuthRequired {\n\t\tgetCert = func() (*tls.Certificate, error) {\n\t\t\tcert, err := clientProvider.FetchClientCertificate(isWorker)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\n\t\t\tif cert == nil {\n\t\t\t\treturn nil, fmt.Errorf(\"client auth required, but no certificate provided\")\n\t\t\t}\n\t\t\treturn cert, nil\n\t\t}\n\t}\n\n\treturn auth.NewDynamicTLSClientConfig(\n\t\tgetCert,\n\t\tserverCa,\n\t\tserverName,\n\t\tenableHostVerification,\n\t), nil\n}\n\nfunc (s *localStoreTlsProvider) timerCallback() {\n\tfor {\n\t\tselect {\n\t\tcase <-s.stop:\n\t\t\treturn","sourceCodeStart":372,"sourceCodeEnd":408,"githubUrl":"https://github.com/temporalio/temporal/blob/bde624efd13fbd3843654058db6d9c716166318b/common/rpc/encryption/local_store_tls_provider.go#L372-L408","documentation":"In newClientTLSConfig, when client auth (mTLS) is required, the fetcher calls clientProvider.FetchClientCertificate(isWorker). If the provider returns success but a nil certificate — meaning it is configured with no client cert available — this explicit error is raised. It prevents silently starting mTLS handshakes with no client identity.","triggerScenarios":"isAuthRequired=true (mutual TLS) but the localStore provider has no client certificate path/data configured, or the configured cert is absent so the fetcher returns (nil, nil).","commonSituations":"Server demands client certs but the client config only sets serverCA and serverName, omitting the client cert/key pair; cert file removed by rotation without config update; worker enabled for mTLS on the server side but client-side cert block left empty.","solutions":["Configure client cert/key data (certDataFile/certData and keyDataFile/keyData) for the relevant client group (internode or frontend).","Obtain a client certificate issued by the server's client CA and mount it for the process.","If mTLS is not intended, disable requireClientAuth on the server so clients are not asked for certificates.","Verify the cert file is populated (not an empty secret) and matches the key."],"exampleFix":"// before\nclientTLS:\n  internode:\n    serverName: tls-server   # no client cert configured\n// after\nclientTLS:\n  internode:\n    serverName: tls-server\n    certDataFile: /etc/temporal/tls/client.pem\n    keyDataFile: /etc/temporal/tls/client-key.pem","handlingStrategy":"validation","validationCode":"if isAuthRequired {\n    certPEM, err := os.ReadFile(cfg.CertDataFile)\n    if err != nil { return fmt.Errorf(\"client cert unreadable: %w\", err) }\n    keyPEM, err := os.ReadFile(cfg.KeyDataFile)\n    if err != nil { return fmt.Errorf(\"client key unreadable: %w\", err) }\n    if _, err := tls.X509KeyPair(certPEM, keyPEM); err != nil { return fmt.Errorf(\"invalid client keypair: %w\", err) }\n}","typeGuard":null,"tryCatchPattern":"tlsCfg, err := newClientTLSConfig(...)\nif err != nil && strings.Contains(err.Error(), \"client auth required, but no certificate provided\") {\n    return fmt.Errorf(\"mTLS requested but client identity not configured: %w\", err)\n}","preventionTips":["Always configure cert+key whenever the server has requireClientAuth enabled.","Check client cert expiry and renew before rotation windows.","Keep client and server mTLS settings in sync in config review."],"tags":["tls","mtls","client-certificate","authentication"],"backgroundTag":"mtls-client-certificate-missing","analyzedSha":"bde624efd13fbd3843654058db6d9c716166318b","analyzedAt":"2026-09-01T07:18:39.080Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}