{"record":{"id":"eccb15c9ec860037","repo":"hyperledger/fabric","slug":"both-key-and-certificate-are-required-when-using-m","errorCode":null,"errorMessage":"both Key and Certificate are required when using mutual TLS","messagePattern":"both Key and Certificate are required when using mutual TLS","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/pkg/comm/config.go","lineNumber":261,"sourceCode":"\t\t\treturn nil, errors.WithMessage(err, \"failed to load client certificate\")\n\t\t}\n\t\ttlsConfig.Certificates = append(tlsConfig.Certificates, cert)\n\t}\n\n\tif so.TimeShift > 0 {\n\t\ttlsConfig.Time = func() time.Time {\n\t\t\treturn time.Now().Add((-1) * so.TimeShift)\n\t\t}\n\t}\n\n\treturn tlsConfig, nil\n}\n\n// ClientCertificate returns the client certificate that will be used\n// for mutual TLS.\nfunc (so SecureOptions) ClientCertificate() (tls.Certificate, error) {\n\tif so.Key == nil || so.Certificate == nil {\n\t\treturn tls.Certificate{}, errors.New(\"both Key and Certificate are required when using mutual TLS\")\n\t}\n\tcert, err := tls.X509KeyPair(so.Certificate, so.Key)\n\tif err != nil {\n\t\treturn tls.Certificate{}, errors.WithMessage(err, \"failed to create key pair\")\n\t}\n\treturn cert, nil\n}\n\n// KeepaliveOptions is used to set the gRPC keepalive settings for both\n// clients and servers\ntype KeepaliveOptions struct {\n\t// ClientInterval is the duration after which if the client does not see\n\t// any activity from the server it pings the server to see if it is alive\n\tClientInterval time.Duration\n\t// ClientTimeout is the duration the client waits for a response\n\t// from the server after sending a ping before closing the connection\n\tClientTimeout time.Duration\n\t// ServerInterval is the duration after which if the server does not see","sourceCodeStart":243,"sourceCodeEnd":279,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/internal/pkg/comm/config.go#L243-L279","documentation":"Returned by SecureOptions.ClientCertificate when mutual TLS is requested but either Key or Certificate bytes are nil. Building a tls.Certificate requires both halves of the keypair, so the guard rejects the incomplete SecureOptions.","triggerScenarios":"Thrown at internal/pkg/comm/config.go:261 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide both peer.tls.clientKey.file and peer.tls.clientCert.file","Ensure neither config path is empty when mutual TLS is required"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}