{"record":{"id":"b2ac5d887546ad20","repo":"thanos-io/thanos","slug":"client-cert-file-q-specified-without-client-key-f","errorCode":null,"errorMessage":"client cert file %q specified without client key file","messagePattern":"client cert file %q specified without client key file","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/exthttp/tlsconfig.go","lineNumber":47,"sourceCode":"\ttlsConfig := &tls.Config{InsecureSkipVerify: cfg.InsecureSkipVerify}\n\n\t// If a CA cert is provided then let's read it in.\n\tif len(cfg.CAFile) > 0 {\n\t\tb, err := readCAFile(cfg.CAFile)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif !updateRootCA(tlsConfig, b) {\n\t\t\treturn nil, fmt.Errorf(\"unable to use specified CA cert %s\", cfg.CAFile)\n\t\t}\n\t}\n\n\tif len(cfg.ServerName) > 0 {\n\t\ttlsConfig.ServerName = cfg.ServerName\n\t}\n\t// If a client cert & key is provided then configure TLS config accordingly.\n\tif len(cfg.CertFile) > 0 && len(cfg.KeyFile) == 0 {\n\t\treturn nil, fmt.Errorf(\"client cert file %q specified without client key file\", cfg.CertFile)\n\t} else if len(cfg.KeyFile) > 0 && len(cfg.CertFile) == 0 {\n\t\treturn nil, fmt.Errorf(\"client key file %q specified without client cert file\", cfg.KeyFile)\n\t} else if len(cfg.CertFile) > 0 && len(cfg.KeyFile) > 0 {\n\t\t// Verify that client cert and key are valid.\n\t\tif _, err := cfg.getClientCertificate(nil); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\ttlsConfig.GetClientCertificate = cfg.getClientCertificate\n\t}\n\n\treturn tlsConfig, nil\n}\n\n// readCAFile reads the CA cert file from disk.\nfunc readCAFile(f string) ([]byte, error) {\n\tdata, err := os.ReadFile(f)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to load specified CA cert %s: %s\", f, err)","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/pkg/exthttp/tlsconfig.go#L29-L65","documentation":"A pairing guard in NewTLSConfig: the configuration specifies a client certificate file (tls_configs.cert_file) without the corresponding key file (key_file). A mTLS client identity needs both halves; the guard fires before any network activity, naming the cert file at fault.","triggerScenarios":"Thrown at pkg/exthttp/tlsconfig.go:47 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide both cert_file and key_file, or remove cert_file.","Check flag/config wiring so both files are set together."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}