{"record":{"id":"b548e8755f570554","repo":"ory/hydra","slug":"tls-configuration-is-invalid","errorCode":null,"errorMessage":"tls configuration is invalid","messagePattern":"tls configuration is invalid","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/tlsx/cert.go","lineNumber":39,"sourceCode":"\t\"math/big\"\n\t\"os\"\n\t\"path/filepath\"\n\t\"slices\"\n\t\"sync/atomic\"\n\t\"testing\"\n\t\"time\"\n\n\t\"github.com/pkg/errors\"\n\t\"github.com/stretchr/testify/require\"\n\n\t\"github.com/ory/x/watcherx\"\n)\n\n// ErrNoCertificatesConfigured is returned when no TLS configuration was found.\nvar ErrNoCertificatesConfigured = errors.New(\"no tls configuration was found\")\n\n// ErrInvalidCertificateConfiguration is returned when an invalid TLS configuration was found.\nvar ErrInvalidCertificateConfiguration = errors.New(\"tls configuration is invalid\")\n\n// HTTPSCertificate returns loads a HTTP over TLS Certificate by looking at environment variables.\nfunc HTTPSCertificate() ([]tls.Certificate, error) {\n\tprefix := \"HTTPS_TLS\"\n\treturn Certificate(\n\t\tos.Getenv(prefix+\"_CERT\"), os.Getenv(prefix+\"_KEY\"),\n\t\tos.Getenv(prefix+\"_CERT_PATH\"), os.Getenv(prefix+\"_KEY_PATH\"),\n\t)\n}\n\n// HTTPSCertificateHelpMessage returns a help message for configuring HTTP over TLS Certificates.\nfunc HTTPSCertificateHelpMessage() string {\n\treturn CertificateHelpMessage(\"HTTPS_TLS\")\n}\n\n// CertificateHelpMessage returns a help message for configuring TLS Certificates.\nfunc CertificateHelpMessage(prefix string) string {\n\treturn `- ` + prefix + `_CERT_PATH: The path to the TLS certificate (pem encoded).","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/tlsx/cert.go#L21-L57","documentation":"ErrInvalidCertificateConfiguration is returned when TLS material was provided but is not valid — the loading path exhausts all supported configurations (env/base64 and file sources) without producing a usable certificate. It indicates a malformed or incomplete TLS setup rather than a missing one.","triggerScenarios":"Calling Certificate() with some TLS inputs set, but none forming a complete valid pair — e.g. only CERT base64 without KEY, PEM data that fails to decode or parse, or paths pointing at unreadable/invalid files so the loader falls through all branches to cert.go:123.","commonSituations":"Corrupted or truncated base64-encoded certificates; a certificate whose key does not match; secret mounts containing the wrong files; rotation scripts writing half-updated certificates; unsupported key or cert formats passed to the loader.","solutions":["Verify the certificate and key form a matching, parseable PEM pair (openssl x509/x509keypair check)","Provide the full configuration for one source: both cert+key as base64, or both as valid file paths","Check file permissions and mount paths so the key/cert files are readable at runtime","Re-issue or re-export the certificate if it fails to decode; confirm correct base64 encoding without newlines","Compare against a known-good TLS configuration (e.g. from a working deployment)"],"exampleFix":"// before\nCertificate(base64Cert, \"\", \"\", \"\") // key missing -> ErrInvalidCertificateConfiguration\n// after\nCertificate(base64Cert, base64Key, \"\", \"\") // complete PEM pair","handlingStrategy":"try-catch","validationCode":"if certPEM != \"\" {\n\tif _, err := base64.StdEncoding.DecodeString(certPEM); err != nil {\n\t\treturn fmt.Errorf(\"TLS_CERT is not valid base64: %w\", err)\n\t}\n}\nif _, err := tls.X509KeyPair(pemCert, pemKey); err != nil {\n\treturn fmt.Errorf(\"cert/key invalid or mismatched: %w\", err)\n}","typeGuard":"func isInvalidCertConfig(err error) bool {\n\treturn errors.Is(err, tlsx.ErrInvalidCertificateConfiguration)\n}","tryCatchPattern":"certs, err := tlsx.Certificate(certPEM, keyPEM, certPath, keyPath)\nif err != nil {\n\tif errors.Is(err, tlsx.ErrInvalidCertificateConfiguration) {\n\t\treturn nil, fmt.Errorf(\"TLS config invalid: check cert/key pairing and formats\")\n\t}\n\treturn nil, err\n}","preventionTips":["Validate cert/key pairs with tls.X509KeyPair (or openssl) at deploy time","Ensure base64 encodings are complete and newline-safe","After certificate rotation, confirm both cert and key were updated together","Check file readability/paths for file-based TLS configuration"],"tags":["go","tls","configuration","certificates"],"backgroundTag":"tls-config-invalid","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}