{"record":{"id":"c76279ec49a52019","repo":"juicedata/juicefs","slug":"error-loading-certificate-and-key-file-s","errorCode":null,"errorMessage":"error loading certificate and key file: %s","messagePattern":"error loading certificate and key file: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/format.go","lineNumber":261,"sourceCode":"\tif u, err := url.Parse(format.Bucket); err == nil {\n\t\tvalues := u.Query()\n\t\tif values.Get(\"tls-insecure-skip-verify\") != \"\" {\n\t\t\tvar tlsSkipVerify bool\n\t\t\tif tlsSkipVerify, err = strconv.ParseBool(values.Get(\"tls-insecure-skip-verify\")); err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t\tobject.GetHttpClient().Transport.(*http.Transport).TLSClientConfig.InsecureSkipVerify = tlsSkipVerify\n\t\t\tvalues.Del(\"tls-insecure-skip-verify\")\n\t\t\tu.RawQuery = values.Encode()\n\t\t\tformat.Bucket = u.String()\n\t\t}\n\n\t\t// Configure client TLS when params are provided\n\t\tif values.Get(\"ca-certs\") != \"\" && values.Get(\"ssl-cert\") != \"\" && values.Get(\"ssl-key\") != \"\" {\n\n\t\t\tclientTLSCert, err := tls.LoadX509KeyPair(values.Get(\"ssl-cert\"), values.Get(\"ssl-key\"))\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error loading certificate and key file: %s\", err.Error())\n\t\t\t}\n\n\t\t\tcertPool := x509.NewCertPool()\n\t\t\tcaCertPEM, err := os.ReadFile(values.Get(\"ca-certs\"))\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error loading CA cert file: %s\", err.Error())\n\t\t\t}\n\n\t\t\tif certAdded := certPool.AppendCertsFromPEM(caCertPEM); !certAdded {\n\t\t\t\treturn nil, fmt.Errorf(\"error appending CA cert to pool\")\n\t\t\t}\n\n\t\t\tobject.GetHttpClient().Transport.(*http.Transport).TLSClientConfig.RootCAs = certPool\n\t\t\tobject.GetHttpClient().Transport.(*http.Transport).TLSClientConfig.Certificates = []tls.Certificate{clientTLSCert}\n\t\t}\n\t}\n\n\tif format.Shards > 1 {","sourceCodeStart":243,"sourceCodeEnd":279,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/cmd/format.go#L243-L279","documentation":"When the object storage URL carries `ca-certs`, `ssl-cert`, and `ssl-key` query parameters, createStorage configures client-side TLS via tls.LoadX509KeyPair. This error means Go's TLS loader could not read or parse the certificate/key files (bad path, wrong PEM format, mismatched pair, or encrypted key without password support).","triggerScenarios":"`juicefs mount`/`format` with a storage URL like `...?ca-certs=ca.pem&ssl-cert=client.pem&ssl-key=client.key` where any of the cert/key files is missing, unreadable, malformed, or the cert and key do not form a matching pair.","commonSituations":"Typo in file paths relative to working directory; certificate file in DER instead of PEM; cert and key from different issuers; files unreadable due to permissions (or not present inside container image).","solutions":["Verify ssl-cert and ssl-key paths exist and are readable from the client's working directory.","Ensure both files are PEM-encoded (BEGIN CERTIFICATE / BEGIN PRIVATE KEY).","Confirm the certificate and key are a matching pair (compare modulus/public key hashes).","Remove/rename the TLS params in the bucket URL if client TLS is not actually required."],"exampleFix":"// before\nobject storage url: s3://bucket?ca-certs=/etc/certs/ca.crt&ssl-cert=/etc/certs/client.crt&ssl-key=/etc/certs/old.key\n// after\nobject storage url: s3://bucket?ca-certs=/etc/certs/ca.crt&ssl-cert=/etc/certs/client.crt&ssl-key=/etc/certs/client.key","handlingStrategy":"validation","validationCode":"if _, err := tls.LoadX509KeyPair(sslCert, sslKey); err != nil {\n\treturn fmt.Errorf(\"client TLS pair invalid before mount: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"clientTLSCert, err := tls.LoadX509KeyPair(cert, key)\nif err != nil {\n\treturn nil, fmt.Errorf(\"error loading certificate and key file: %s\", err.Error())\n}","preventionTips":["Use absolute paths for ssl-cert/ssl-key in the storage URL.","Keep cert and key files together in one directory and rotate them as a pair.","Ensure PEM format (not DER); convert with `openssl x509 -in cert.der -outform PEM`.","Verify the pair matches: compare `openssl x509 -noout -modulus` and `openssl rsa -noout -modulus` hashes."],"tags":["tls","certificates","object-storage"],"backgroundTag":"file-not-found","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}