{"record":{"id":"acd4da600c82ccf7","repo":"t8y2/dbx","slug":"both-client-certificate-and-client-key-are-require","errorCode":null,"errorMessage":"both client certificate and client key are required","messagePattern":"both client certificate and client key are required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/neo4j-go/driver.go","lineNumber":89,"sourceCode":"\tvar tlsConfig *tls.Config\n\tif params.CACertPath != \"\" {\n\t\tcertificate, err := os.ReadFile(params.CACertPath)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"read Neo4j CA certificate: %w\", err)\n\t\t}\n\t\troots, err := x509.SystemCertPool()\n\t\tif err != nil || roots == nil {\n\t\t\troots = x509.NewCertPool()\n\t\t}\n\t\tif !roots.AppendCertsFromPEM(certificate) {\n\t\t\treturn nil, errors.New(\"Neo4j CA certificate contains no valid PEM certificate\")\n\t\t}\n\t\ttlsConfig = &tls.Config{MinVersion: tls.VersionTLS12, RootCAs: roots}\n\t}\n\tvar clientCertificateProvider neo4jauth.ClientCertificateProvider\n\tif params.ClientCertPath != \"\" || params.ClientKeyPath != \"\" {\n\t\tif params.ClientCertPath == \"\" || params.ClientKeyPath == \"\" {\n\t\t\treturn nil, errors.New(\"both client certificate and client key are required\")\n\t\t}\n\t\tprovider, err := neo4jauth.NewStaticClientCertificateProvider(neo4jauth.ClientCertificate{\n\t\t\tCertFile: params.ClientCertPath,\n\t\t\tKeyFile:  params.ClientKeyPath,\n\t\t})\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"load Neo4j client certificate: %w\", err)\n\t\t}\n\t\tclientCertificateProvider = provider\n\t}\n\tif tlsConfig == nil && clientCertificateProvider == nil {\n\t\treturn nil, nil\n\t}\n\treturn func(driverConfig *config.Config) {\n\t\tif tlsConfig != nil {\n\t\t\tdriverConfig.TlsConfig = tlsConfig\n\t\t}\n\t\tif clientCertificateProvider != nil {","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/neo4j-go/driver.go#L71-L107","documentation":"The driver supports mutual TLS: if either a client certificate or a client key is configured, both must be supplied, because a TLS client cert pair is meaningless (and would fail the handshake) without its matching private key. The configurer validates this pair before constructing the certificate provider.","triggerScenarios":"Calling openDriver with params.ClientCertPath set but params.ClientKeyPath empty, or vice versa, when targeting a Neo4j instance requiring client certificates.","commonSituations":"Mounting only the cert into a container while the key remains a secret elsewhere; setting CLIENT_CERT_PATH but forgetting CLIENT_KEY_PATH; typo'd env var name for the key path.","solutions":["Provide both params.ClientCertPath and params.ClientKeyPath together.","If mutual TLS is not intended, clear both values so neither is set.","Verify both files exist and are readable; the cert and key must be a matching pair."],"exampleFix":"// before\nparams.ClientCertPath = \"/certs/client.pem\" // key path missing\n// after\nparams.ClientCertPath = \"/certs/client.pem\"\nparams.ClientKeyPath = \"/certs/client-key.pem\"","handlingStrategy":"validation","validationCode":"if (certPath == \"\") != (keyPath == \"\") {\n    return errors.New(\"client TLS requires both cert and key paths\")\n}\nfor _, p := range []string{certPath, keyPath} {\n    if p != \"\" {\n        if _, err := os.Stat(p); err != nil {\n            return fmt.Errorf(\"TLS file missing: %s\", p)\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set cert and key config values together, never one alone","Verify mounted secret files exist in containers at startup","Use a config struct whose constructor requires both fields","Document which env vars form the mutual-TLS pair"],"tags":["tls","neo4j","mutual-tls","configuration"],"backgroundTag":"incomplete-tls-client-config","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}