{"record":{"id":"a405aa8d1b221588","repo":"ory/hydra","slug":"unable-to-load-x509-key-pair-from-files-v","errorCode":null,"errorMessage":"unable to load X509 key pair from files: %v","messagePattern":"unable to load X509 key pair from files: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/tlsx/cert.go","lineNumber":118,"sourceCode":"\tcertPEMBase64, keyPEMBase64 string,\n\tcertPath, keyPath string,\n) ([]tls.Certificate, error) {\n\tif certPEMBase64 == \"\" && keyPEMBase64 == \"\" && certPath == \"\" && keyPath == \"\" {\n\t\treturn nil, errors.WithStack(ErrNoCertificatesConfigured)\n\t}\n\n\tif certPEMBase64 != \"\" && keyPEMBase64 != \"\" {\n\t\tcert, err := CertificateFromBase64(certPEMBase64, keyPEMBase64)\n\t\tif err != nil {\n\t\t\treturn nil, errors.WithStack(err)\n\t\t}\n\t\treturn []tls.Certificate{cert}, nil\n\t}\n\n\tif certPath != \"\" && keyPath != \"\" {\n\t\tcert, err := tls.LoadX509KeyPair(certPath, keyPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unable to load X509 key pair from files: %v\", err)\n\t\t}\n\t\treturn []tls.Certificate{cert}, nil\n\t}\n\n\treturn nil, errors.WithStack(ErrInvalidCertificateConfiguration)\n}\n\ntype CertFunc = func(*tls.ClientHelloInfo) (*tls.Certificate, error)\n\n// GetCertificate returns a function for use with\n// \"net/tls\".Config.GetCertificate.\n//\n// The certificate and private key are read from the specified filesystem paths.\n// The certificate file is watched for changes, upon which the cert+key are\n// reloaded in the background. Errors during reloading are deduplicated and\n// reported through the errs channel if it is not nil. When the provided context\n// is canceled, background reloading stops and the errs channel is closed.\n//","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/tlsx/cert.go#L100-L136","documentation":"Certificate resolves TLS material from paths or base64 strings. When both a cert path and key path are provided, it calls tls.LoadX509KeyPair; this error wraps any failure reading or parsing those files — missing files, permission denied, or invalid/unmatched PEM contents.","triggerScenarios":"Calling Certificate with non-empty certPath and keyPath where the files do not exist, are unreadable, contain non-PEM data, or the key does not match the certificate.","commonSituations":"Wrong paths in config (relative path vs working directory), container missing the mounted secret, permissions after secret rotation, DER instead of PEM, or cert/key pair mismatch after cert renewal.","solutions":["Verify both files exist and are readable by the process (ls -l, check mount/secret volume)","Convert files to PEM format if they are DER (openssl x509 -inform der -outform pem)","Ensure cert and key are a matching pair (compare moduli with openssl)","Use absolute paths or set the correct working directory; re-check config/env values"],"exampleFix":"// before\ncert, err := Certificate(\"/etc/ssl/cert.der\", \"/etc/ssl/key.pem\", \"\", \"\")\n// after (convert DER to PEM first)\n// openssl x509 -inform der -in cert.der -out cert.pem\ncert, err := Certificate(\"/etc/ssl/cert.pem\", \"/etc/ssl/key.pem\", \"\", \"\")","handlingStrategy":"validation","validationCode":"func checkCertFiles(certPath, keyPath string) error {\n    for _, p := range []string{certPath, keyPath} {\n        if fi, err := os.Stat(p); err != nil || fi.IsDir() {\n            return fmt.Errorf(\"missing/unreadable %s\", p)\n        }\n    }\n    _, err := tls.LoadX509KeyPair(certPath, keyPath)\n    return err\n}","typeGuard":null,"tryCatchPattern":"certs, err := tlsx.Certificate(certPath, keyPath, \"\", \"\")\nif err != nil && strings.Contains(err.Error(), \"X509 key pair from files\") {\n    log.WithError(err).Errorf(\"check paths %q / %q exist, are PEM, and form a matching pair\", certPath, keyPath)\n    return err\n}","preventionTips":["Mount secrets read-only and verify with a startup readiness check","Use absolute paths; confirm the process working directory","Keep cert/key files PEM and matched (renew both together)"],"tags":["tls","x509","file-not-found","certificate"],"backgroundTag":"tls-certificate-load-failed","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}