{"record":{"id":"b23ec24e04ddf21b","repo":"denoland/deno","slug":"no-private-key-found-in-otel-exporter-otlp-client","errorCode":null,"errorMessage":"no private key found in OTEL_EXPORTER_OTLP_CLIENT_KEY file","messagePattern":"no private key found in OTEL_EXPORTER_OTLP_CLIENT_KEY file","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ext/telemetry/lib.rs","lineNumber":841,"sourceCode":"        }\n      } else {\n        let ca_certs = match std::env::var(\"OTEL_EXPORTER_OTLP_CERTIFICATE\") {\n          Ok(path) => vec![sys.fs_read(path)?.into_owned()],\n          _ => vec![],\n        };\n\n        let keys = match (\n          std::env::var(\"OTEL_EXPORTER_OTLP_CLIENT_KEY\"),\n          std::env::var(\"OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE\"),\n        ) {\n          (Ok(key_path), Ok(cert_path)) => {\n            let key = sys.fs_read(key_path)?;\n            let cert = sys.fs_read(cert_path)?;\n\n            let certs = load_certs(&mut std::io::Cursor::new(cert))?;\n            let key =\n              load_private_keys(&key)?.into_iter().next().ok_or_else(|| {\n                deno_core::anyhow::anyhow!(\n                  \"no private key found in OTEL_EXPORTER_OTLP_CLIENT_KEY file\"\n                )\n              })?;\n\n            TlsKeys::Static(TlsKey(certs, key))\n          }\n          _ => TlsKeys::Null,\n        };\n\n        let tls_config =\n          create_client_config(deno_tls::TlsClientConfigOptions {\n            root_cert_store: None,\n            ca_certs,\n            unsafely_ignore_certificate_errors: None,\n            unsafely_disable_hostname_verification: false,\n            cert_chain_and_key: keys,\n            socket_use: SocketUse::Http,\n          })?;","sourceCodeStart":823,"sourceCodeEnd":859,"githubUrl":"https://github.com/denoland/deno/blob/89f33cbef296a2b287f323d42de54c871fa69c77/ext/telemetry/lib.rs#L823-L859","documentation":"For OTLP mTLS, Deno reads a private key from OTEL_EXPORTER_OTLP_CLIENT_KEY and certificates from OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE (both must be set). load_private_keys must yield at least one key from the key file; a PEM with no private key blocks raises this error.","triggerScenarios":"Both env vars set and the CLIENT_KEY file contains certificates only, is empty, or is in a format the PEM reader cannot parse (e.g. an encrypted key or PKCS#12 bundle).","commonSituations":"Swapping the two paths; pointing both variables at the same full-chain PEM; using encrypted keys where a plain PKCS#1/PKCS#8 PEM is required.","solutions":["Verify the file actually holds a private key: `openssl pkey -in client.key -noout && echo OK`","Point OTEL_EXPORTER_OTLP_CLIENT_KEY at the private-key PEM and OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE at the certificate-chain PEM","Convert encrypted/PKCS#12 material to an unencrypted PEM key: `openssl pkcs12 -nodes -nocerts -in bundle.pfx -out client.key`"],"exampleFix":"# before — CLIENT_KEY points at the certificate\nexport OTEL_EXPORTER_OTLP_CLIENT_KEY=./certs/client.pem\nexport OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE=./certs/client.pem\n\n# after — key file contains the private key\nexport OTEL_EXPORTER_OTLP_CLIENT_KEY=./certs/client.key.pem\nexport OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE=./certs/client.pem","handlingStrategy":"validation","validationCode":"key_file=\"${OTEL_EXPORTER_OTLP_CLIENT_KEY:?}\"\nif ! grep -q \"PRIVATE KEY\" \"$key_file\"; then\n  echo \"$key_file has no PRIVATE KEY PEM block\"; exit 1\nfi\nopenssl pkey -in \"$key_file\" -noout || exit 1","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify the key with `openssl pkey -in client.key -noout` before starting the process","Keep the private-key PEM and the certificate-chain PEM as separate files","Use unencrypted PKCS#8/PKCS#1 PEM keys; convert PKCS#12 bundles with `openssl pkcs12 -nodes`"],"tags":["telemetry","otel","mtls","tls","certificates","env-vars"],"backgroundTag":null,"analyzedSha":"89f33cbef296a2b287f323d42de54c871fa69c77","analyzedAt":"2026-08-16T07:54:21.310Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}