{"record":{"id":"f44438caa4071dfc","repo":"probelabs/goreplay","slug":"missing-tls-client-certificate-in-kafka","errorCode":null,"errorMessage":"missing TLS client certificate in kafka","messagePattern":"missing TLS client certificate in kafka","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kafka.go","lineNumber":74,"sourceCode":"type KafkaMessage struct {\n\tReqURL     string            `json:\"Req_URL\"`\n\tReqType    string            `json:\"Req_Type\"`\n\tReqID      string            `json:\"Req_ID\"`\n\tReqTs      string            `json:\"Req_Ts\"`\n\tReqMethod  string            `json:\"Req_Method\"`\n\tReqBody    string            `json:\"Req_Body,omitempty\"`\n\tReqHeaders map[string]string `json:\"Req_Headers,omitempty\"`\n}\n\n// NewTLSConfig loads TLS certificates\nfunc NewTLSConfig(clientCertFile, clientKeyFile, caCertFile string) (*tls.Config, error) {\n\ttlsConfig := tls.Config{}\n\n\tif clientCertFile != \"\" && clientKeyFile == \"\" {\n\t\treturn &tlsConfig, errors.New(\"Missing key of client certificate in kafka\")\n\t}\n\tif clientCertFile == \"\" && clientKeyFile != \"\" {\n\t\treturn &tlsConfig, errors.New(\"missing TLS client certificate in kafka\")\n\t}\n\t// Load client cert\n\tif (clientCertFile != \"\") && (clientKeyFile != \"\") {\n\t\tcert, err := tls.LoadX509KeyPair(clientCertFile, clientKeyFile)\n\t\tif err != nil {\n\t\t\treturn &tlsConfig, err\n\t\t}\n\t\ttlsConfig.Certificates = []tls.Certificate{cert}\n\t}\n\t// Load CA cert\n\tif caCertFile != \"\" {\n\t\tcaCert, err := ioutil.ReadFile(caCertFile)\n\t\tif err != nil {\n\t\t\treturn &tlsConfig, err\n\t\t}\n\t\tcaCertPool := x509.NewCertPool()\n\t\tcaCertPool.AppendCertsFromPEM(caCert)\n\t\ttlsConfig.RootCAs = caCertPool","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/probelabs/goreplay/blob/251e45abd242886bb64ff2b2dc98789556b56330/kafka.go#L56-L92","documentation":"NewTLSConfig reports that loading the Kafka TLS client certificate/key pair failed (file missing, unreadable, or pair mismatch), surfacing the underlying load error wrapped with this message before the TLS config is used.","triggerScenarios":"Thrown at kafka.go:74 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the cert and key file paths exist and are readable by the gor process","Confirm cert and key match (same key pair, correct PEM encoding)","Regenerate or re-export the client certificate if it is expired or corrupted"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"251e45abd242886bb64ff2b2dc98789556b56330","analyzedAt":"2026-09-02T16:44:11.369Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T21:17:11.164Z"}