{"record":{"id":"ce60ebdfa0865563","repo":"nsqio/nsq","slug":"http-client-tls-cert-must-be-specified-with-ht","errorCode":null,"errorMessage":"--http-client-tls-cert must be specified with --http-client-tls-key","messagePattern":"--http-client-tls-cert must be specified with --http-client-tls-key","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nsqadmin/nsqadmin.go","lineNumber":57,"sourceCode":"\tn := &NSQAdmin{\n\t\tnotifications: make(chan *AdminAction),\n\t}\n\tn.swapOpts(opts)\n\n\tif len(opts.NSQDHTTPAddresses) == 0 && len(opts.NSQLookupdHTTPAddresses) == 0 {\n\t\treturn nil, errors.New(\"--nsqd-http-address or --lookupd-http-address required\")\n\t}\n\n\tif len(opts.NSQDHTTPAddresses) != 0 && len(opts.NSQLookupdHTTPAddresses) != 0 {\n\t\treturn nil, errors.New(\"use --nsqd-http-address or --lookupd-http-address not both\")\n\t}\n\n\tif opts.HTTPClientTLSCert != \"\" && opts.HTTPClientTLSKey == \"\" {\n\t\treturn nil, errors.New(\"--http-client-tls-key must be specified with --http-client-tls-cert\")\n\t}\n\n\tif opts.HTTPClientTLSKey != \"\" && opts.HTTPClientTLSCert == \"\" {\n\t\treturn nil, errors.New(\"--http-client-tls-cert must be specified with --http-client-tls-key\")\n\t}\n\n\tn.httpClientTLSConfig = &tls.Config{\n\t\tInsecureSkipVerify: opts.HTTPClientTLSInsecureSkipVerify,\n\t}\n\tif opts.HTTPClientTLSCert != \"\" && opts.HTTPClientTLSKey != \"\" {\n\t\tcert, err := tls.LoadX509KeyPair(opts.HTTPClientTLSCert, opts.HTTPClientTLSKey)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to LoadX509KeyPair %s, %s - %s\",\n\t\t\t\topts.HTTPClientTLSCert, opts.HTTPClientTLSKey, err)\n\t\t}\n\t\tn.httpClientTLSConfig.Certificates = []tls.Certificate{cert}\n\t}\n\tif opts.HTTPClientTLSRootCAFile != \"\" {\n\t\ttlsCertPool := x509.NewCertPool()\n\t\tcaCertFile, err := os.ReadFile(opts.HTTPClientTLSRootCAFile)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to read TLS root CA file %s - %s\",","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/nsqio/nsq/blob/85cf10c09c6c3c86160d6f0eb156f62d0efc1648/nsqadmin/nsqadmin.go#L39-L75","documentation":"Mirror image of the missing-key case: opts.HTTPClientTLSKey is set while opts.HTTPClientTLSCert is empty, so the X509 key pair for nsqadmin's outbound HTTP client cannot be loaded and New() refuses to start. A TLS private key alone is never sufficient for client-certificate authentication.","triggerScenarios":"Launching nsqadmin with --http-client-tls-key=/path/key.pem but no --http-client-tls-cert. The empty-string check fires before LoadX509KeyPair, so this is about a missing flag, not an unreadable or mismatched file.","commonSituations":"Secrets automation that injects only the key file; PEM bundles where the user assumed the certificate would be discovered automatically; renaming flags during upgrades leaving the cert flag behind.","solutions":["Add the certificate: --http-client-tls-cert=/etc/nsq/client.pem.","Confirm the cert and key match: compare 'openssl x509 -noout -modulus' with 'openssl rsa -noout -modulus'.","If mTLS is not actually required by the servers, remove both TLS client flags entirely."],"exampleFix":"# before\nnsqadmin --nsqd-http-address=10.0.0.1:4151 --http-client-tls-key=/etc/nsq/client.key\n# after\nnsqadmin --nsqd-http-address=10.0.0.1:4151 --http-client-tls-cert=/etc/nsq/client.pem --http-client-tls-key=/etc/nsq/client.key","handlingStrategy":"validation","validationCode":"func validateClientTLSPair(cert, key string) error {\n\tif (cert == \"\") != (key == \"\") {\n\t\treturn errors.New(\"--http-client-tls-cert and --http-client-tls-key must be set together\")\n\t}\n\tif cert != \"\" {\n\t\tif _, err := tls.LoadX509KeyPair(cert, key); err != nil {\n\t\t\treturn fmt.Errorf(\"preflight keypair check failed: %w\", err)\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never ship one half of a TLS pair in config management; the pair is the unit of deployment.","Run openssl moduli comparison in cert-rotation jobs to catch mismatched halves early."],"tags":["nsq","nsqadmin","cli","config","tls"],"backgroundTag":null,"analyzedSha":"85cf10c09c6c3c86160d6f0eb156f62d0efc1648","analyzedAt":"2026-08-16T00:53:05.009Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}