{"record":{"id":"e09a40b843ec5402","repo":"hyperledger/fabric","slug":"loading-client-cert-key-pair-s","errorCode":null,"errorMessage":"loading client cert/key pair: %s","messagePattern":"loading client cert/key pair: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/osnadmin/main.go","lineNumber":101,"sourceCode":"\t\tcaCertPool    *x509.CertPool\n\t\ttlsClientCert tls.Certificate\n\t)\n\t// TLS enabled\n\tif *caFile != \"\" {\n\t\tosnURL = fmt.Sprintf(\"https://%s\", *orderer)\n\t\tvar err error\n\t\tcaCertPool = x509.NewCertPool()\n\t\tcaFilePEM, err := os.ReadFile(*caFile)\n\t\tif err != nil {\n\t\t\treturn \"\", 1, fmt.Errorf(\"reading orderer CA certificate: %s\", err)\n\t\t}\n\t\tif !caCertPool.AppendCertsFromPEM(caFilePEM) {\n\t\t\treturn \"\", 1, errors.New(\"failed to add ca-file PEM to cert pool\")\n\t\t}\n\n\t\ttlsClientCert, err = tls.LoadX509KeyPair(*clientCert, *clientKey)\n\t\tif err != nil {\n\t\t\treturn \"\", 1, fmt.Errorf(\"loading client cert/key pair: %s\", err)\n\t\t}\n\t} else { // TLS disabled\n\t\tosnURL = fmt.Sprintf(\"http://%s\", *orderer)\n\t}\n\n\tvar marshaledConfigBlock []byte\n\tif *configBlockPath != \"\" {\n\t\tmarshaledConfigBlock, err = os.ReadFile(*configBlockPath)\n\t\tif err != nil {\n\t\t\treturn \"\", 1, fmt.Errorf(\"reading config block: %s\", err)\n\t\t}\n\n\t\terr = validateBlockChannelID(marshaledConfigBlock, *joinChannelID)\n\t\tif err != nil {\n\t\t\treturn \"\", 1, err\n\t\t}\n\t}\n","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/cmd/osnadmin/main.go#L83-L119","documentation":"When TLS is enabled, osnadmin loads the admin client's own certificate and private key via tls.LoadX509KeyPair from --client-cert and --client-key. If either file cannot be read or the pair is invalid (mismatched key/cert, bad PEM), this error is returned and the command exits. The orderer's admin API requires client TLS certificates to authenticate requests.","triggerScenarios":"--client-cert/--client-key paths missing or unreadable; cert and key not a matching pair; key encrypted (passphrase-protected); PEM blocks invalid.","commonSituations":"Swapping cert and key arguments; regenerated orderer TLS material while old client certs are still referenced; key generated for a different cert after rotation; encrypted keys from older tooling.","solutions":["Verify both files exist and are readable, and that you didn't swap --client-cert and --client-key.","Confirm cert and key match: compare their public keys via openssl x509 -noout -modulus / openssl rsa -noout -modulus (or -pubkey comparison).","Re-export a fresh client cert/key pair from the admin/OrdererAdmin MSP if rotation occurred.","Decrypt the key if passphrase-protected, or regenerate an unencrypted key for automated use."],"exampleFix":"// before (swapped flags)\nosnadmin channel join ... --client-cert ./tls/server.key --client-key ./tls/server.crt\n// after\nosnadmin channel join ... --client-cert ./tls/server.crt --client-key ./tls/server.key","handlingStrategy":"validation","validationCode":"if _, err := tls.LoadX509KeyPair(clientCert, clientKey); err != nil {\n    log.Fatalf(\"client TLS material invalid: %v\", err)\n}\n// also verify cert/key pairing by parsing both and comparing public keys","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Double-check --client-cert takes the .crt and --client-key the .key","Re-export fresh admin certs after any TLS material rotation","Avoid passphrase-protected keys in automation","Validate the pair with openssl before running osnadmin"],"tags":["tls","osnadmin","certificate","mtls"],"backgroundTag":"tls-client-cert-load-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}