{"record":{"id":"cbe3f73d24c03cd4","repo":"locustio/locust","slug":"could-not-find-the-tls-key-file-invalid-path-co","errorCode":null,"errorMessage":"Could not find the TLS key file, invalid path: {conn.key_file}","messagePattern":"Could not find the TLS key file, invalid path: (.+?)","errorType":"exception","errorClass":"OSError","httpStatus":null,"severity":"error","filePath":"locust/clients.py","lineNumber":526,"sourceCode":"                    conn.ca_certs = cert_loc\n                else:\n                    conn.ca_cert_dir = cert_loc\n        else:\n            conn.cert_reqs = \"CERT_NONE\"\n            conn.ca_certs = None\n            conn.ca_cert_dir = None\n\n        if cert:\n            if not isinstance(cert, basestring):\n                conn.cert_file = cert[0]\n                conn.key_file = cert[1]\n            else:\n                conn.cert_file = cert\n                conn.key_file = None\n            if conn.cert_file and not os.path.exists(conn.cert_file):\n                raise OSError(f\"Could not find the TLS certificate file, invalid path: {conn.cert_file}\")\n            if conn.key_file and not os.path.exists(conn.key_file):\n                raise OSError(f\"Could not find the TLS key file, invalid path: {conn.key_file}\")\n\n    def build_connection_pool_key_attributes(self, request, verify, cert=None):\n        host_params, pool_kwargs = super().build_connection_pool_key_attributes(request, verify, cert)\n\n        if requests_version >= (2, 32, 5) and verify is True:\n            pool_kwargs[\"ssl_context\"] = _preloaded_ssl_context\n\n        return host_params, pool_kwargs\n\n\n# Monkey patch Response class to give some guidance\ndef _missing_catch_response_True(self, *_args, **_kwargs):\n    raise LocustError(\n        \"If you want to change the state of the request using .success() or .failure(), you must pass catch_response=True. See http://docs.locust.io/en/stable/writing-a-locustfile.html#validating-responses\"\n    )\n\n\nResponse.success = _missing_catch_response_True  # type: ignore[attr-defined]","sourceCodeStart":508,"sourceCodeEnd":544,"githubUrl":"https://github.com/locustio/locust/blob/f391a716e12c2c712e80b5835e877b7933397453/locust/clients.py#L508-L544","documentation":"When `cert` is a (cert, key) tuple, cert_verify assigns conn.key_file and validates it exists, raising OSError if the key file is missing. Both the cert and its private key must be readable for mTLS to work.","triggerScenarios":"Passing `cert=(\"/path/client.crt\", \"/path/client.key\")` where the key path does not exist on disk.","commonSituations":"Deploying only the cert but not the key; key stored in a separate secret not mounted; typos or wrong extension (.pem vs .key); permissions blocking read.","solutions":["Verify the key path exists: `ls -l /path/client.key`","Mount the key file (e.g. as a Kubernetes/Docker secret) and use absolute paths","Check the tuple order: (cert, key), not (key, cert)","Ensure the Locust process has read permission on the key"],"exampleFix":"// before\nclient.get(\"/\", cert=(\"/certs/client.crt\", \"/certs/client.key\"))  # key not mounted\n// after\nclient.get(\"/\", cert=(\"/secrets/tls/client.crt\", \"/secrets/tls/client.key\"))  # both mounted","handlingStrategy":"validation","validationCode":"import os\nkey_path = \"/path/client.key\"\nassert os.path.exists(key_path) and os.access(key_path, os.R_OK), f\"TLS key missing/unreadable: {key_path}\"","typeGuard":"def has_cert_key_pair(cert):\n    return (isinstance(cert, (list, tuple)) and len(cert) == 2\n            and all(os.path.exists(p) for p in cert))","tryCatchPattern":"try:\n    client.get(url, cert=(crt, key))\nexcept OSError as e:\n    logger.error(\"TLS key invalid: %s\", e)","preventionTips":["Deploy cert AND key together (same secret)","Confirm tuple order (cert, key)","Pre-flight check both files before starting the swarm"],"tags":["tls","ssl","client-certificate","mtls"],"backgroundTag":"tls-certificate-file-missing","analyzedSha":"f391a716e12c2c712e80b5835e877b7933397453","analyzedAt":"2026-08-29T00:36:13.872Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}