{"record":{"id":"bd83d08dab2f26d8","repo":"valyala/fasthttp","slug":"cannot-load-tls-key-pair-from-the-provided-cert-da","errorCode":null,"errorMessage":"cannot load tls key pair from the provided cert data(%d) and key data(%d): %w","messagePattern":"cannot load tls key pair from the provided cert data\\((.+?)\\) and key data\\((.+?)\\): %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server.go","lineNumber":1957,"sourceCode":"\tif err != nil {\n\t\treturn err\n\t}\n\n\ts.mu.Lock()\n\ts.appendCertLocked(&cert)\n\ts.mu.Unlock()\n\n\treturn nil\n}\n\nfunc x509KeyPair(certData, keyData []byte) (tls.Certificate, error) {\n\tif len(certData) == 0 && len(keyData) == 0 {\n\t\treturn tls.Certificate{}, errNoCertOrKeyProvided\n\t}\n\n\tcert, err := tls.X509KeyPair(certData, keyData)\n\tif err != nil {\n\t\treturn tls.Certificate{}, fmt.Errorf(\"cannot load tls key pair from the provided cert data(%d) and key data(%d): %w\",\n\t\t\tlen(certData), len(keyData), err)\n\t}\n\treturn cert, nil\n}\n\nfunc (s *Server) appendCertLocked(cert *tls.Certificate) {\n\ts.configTLS()\n\ts.TLSConfig.Certificates = append(s.TLSConfig.Certificates, *cert)\n}\n\nfunc (s *Server) configTLS() {\n\tif s.TLSConfig == nil {\n\t\ts.TLSConfig = &tls.Config{}\n\t}\n}\n\n// DefaultConcurrency is the maximum number of concurrent connections\n// the Server may serve by default (i.e. if Server.Concurrency isn't set).","sourceCodeStart":1939,"sourceCodeEnd":1975,"githubUrl":"https://github.com/valyala/fasthttp/blob/c96f600972c6f4a7a30d664257b340ebe9d60124/server.go#L1939-L1975","documentation":"Returned by Server.AppendCertEmbed when tls.X509KeyPair fails to parse the in-memory certificate/key byte slices. Same as the file-based variant but for embedded data; the wrapped error includes the byte lengths of the provided data. The server aborts TLS setup because the pair is invalid.","triggerScenarios":"Calling AppendCertEmbed with certData/keyData that are not valid PEM, don't form a matching pair, are swapped (cert passed as key), are empty-prefixed/garbage bytes, or come from go:embed paths embedding the wrong files.","commonSituations":"Embedding encrypted (password-protected) keys; passing DER-encoded blobs instead of PEM; accidentally embedding the CSR or fullchain in the key slot; build pipeline injecting placeholder bytes.","solutions":["Check the byte slices are valid PEM: they should start with -----BEGIN CERTIFICATE----- / -----BEGIN ... PRIVATE KEY----- (use bytes.HasPrefix to assert before calling).","Confirm cert and key are not swapped and form a matching pair (compare moduli via openssl).","Decrypt password-protected keys at build time or store unencrypted keys with restricted access.","Fix go:embed patterns to include the correct files and verify with a small test parsing them via tls.X509KeyPair."],"exampleFix":"// before\ncertData, _ := assets.ReadFile(\"wrong_cert.bin\")\napp.AppendCertEmbed(certData, keyData)\n// after\ncertData, _ := assets.ReadFile(\"certs/fullchain.pem\")\nkeyData, _ := assets.ReadFile(\"certs/privkey.pem\")\nif err := app.AppendCertEmbed(certData, keyData); err != nil { log.Fatal(err) }","handlingStrategy":"validation","validationCode":"func validateCertData(certData, keyData []byte) error {\n    if !bytes.HasPrefix(certData, []byte(\"-----BEGIN\")) { return errors.New(\"cert is not PEM\") }\n    if !bytes.Contains(keyData, []byte(\"PRIVATE KEY\")) { return errors.New(\"key is not PEM\") }\n    if _, err := tls.X509KeyPair(certData, keyData); err != nil { return err }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if err := app.AppendCertEmbed(certData, keyData); err != nil {\n    if strings.Contains(err.Error(), \"provided cert data\") {\n        log.Fatalf(\"embedded cert/key invalid (PEM? swapped?): %v\", err)\n    }\n    log.Fatal(err)\n}","preventionTips":["Add a unit test that parses embedded cert/key with tls.X509KeyPair at build time.","Verify go:embed patterns match the intended PEM files.","Never embed encrypted keys; store keys unencrypted with restricted file access.","Assert PEM headers before passing data to AppendCertEmbed."],"tags":["go","tls","embedded-certificates"],"backgroundTag":"tls-key-pair-load-failed","analyzedSha":"c96f600972c6f4a7a30d664257b340ebe9d60124","analyzedAt":"2026-08-31T22:48:28.265Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}