{"record":{"id":"bf1c09b502921faa","repo":"thanos-io/thanos","slug":"client-key-file-q-specified-without-client-cert-f","errorCode":null,"errorMessage":"client key file %q specified without client cert file","messagePattern":"client key file %q specified without client cert file","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/exthttp/tlsconfig.go","lineNumber":49,"sourceCode":"\t// If a CA cert is provided then let's read it in.\n\tif len(cfg.CAFile) > 0 {\n\t\tb, err := readCAFile(cfg.CAFile)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif !updateRootCA(tlsConfig, b) {\n\t\t\treturn nil, fmt.Errorf(\"unable to use specified CA cert %s\", cfg.CAFile)\n\t\t}\n\t}\n\n\tif len(cfg.ServerName) > 0 {\n\t\ttlsConfig.ServerName = cfg.ServerName\n\t}\n\t// If a client cert & key is provided then configure TLS config accordingly.\n\tif len(cfg.CertFile) > 0 && len(cfg.KeyFile) == 0 {\n\t\treturn nil, fmt.Errorf(\"client cert file %q specified without client key file\", cfg.CertFile)\n\t} else if len(cfg.KeyFile) > 0 && len(cfg.CertFile) == 0 {\n\t\treturn nil, fmt.Errorf(\"client key file %q specified without client cert file\", cfg.KeyFile)\n\t} else if len(cfg.CertFile) > 0 && len(cfg.KeyFile) > 0 {\n\t\t// Verify that client cert and key are valid.\n\t\tif _, err := cfg.getClientCertificate(nil); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\ttlsConfig.GetClientCertificate = cfg.getClientCertificate\n\t}\n\n\treturn tlsConfig, nil\n}\n\n// readCAFile reads the CA cert file from disk.\nfunc readCAFile(f string) ([]byte, error) {\n\tdata, err := os.ReadFile(f)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to load specified CA cert %s: %s\", f, err)\n\t}\n\treturn data, nil","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/pkg/exthttp/tlsconfig.go#L31-L67","documentation":"A pairing guard in NewTLSConfig, the mirror of the cert-without-key case: a client key file (key_file) is configured without its certificate (cert_file). Pure configuration validation; no TLS handshake is attempted.","triggerScenarios":"Thrown at pkg/exthttp/tlsconfig.go:49 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide both key_file and cert_file, or remove key_file.","Check flag/config wiring so both files are set together."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}