{"record":{"id":"f5b715d10f5c8431","repo":"astral-sh/uv","slug":"pip-compile-s-client-cert-is-unsupported-uv-d","errorCode":null,"errorMessage":"pip-compile's `--client-cert` is unsupported (uv doesn't support dedicated client certificates)","messagePattern":"pip-compile's `--client-cert` is unsupported \\(uv doesn't support dedicated client certificates\\)","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/uv-cli/src/compat.rs","lineNumber":111,"sourceCode":"                        \"pip-compile's `--resolver=backtracking` has no effect (uv always backtracks)\"\n                    );\n                }\n                Resolver::Legacy => {\n                    return Err(anyhow!(\n                        \"pip-compile's `--resolver=legacy` is unsupported (uv always backtracks)\"\n                    ));\n                }\n            }\n        }\n\n        if self.max_rounds.is_some() {\n            return Err(anyhow!(\n                \"pip-compile's `--max-rounds` is unsupported (uv always resolves until convergence)\"\n            ));\n        }\n\n        if self.client_cert.is_some() {\n            return Err(anyhow!(\n                \"pip-compile's `--client-cert` is unsupported (uv doesn't support dedicated client certificates)\"\n            ));\n        }\n\n        if self.emit_trusted_host {\n            return Err(anyhow!(\n                \"pip-compile's `--emit-trusted-host` is unsupported\"\n            ));\n        }\n\n        if self.no_emit_trusted_host {\n            warn_user!(\n                \"pip-compile's `--no-emit-trusted-host` has no effect (uv never emits trusted hosts)\"\n            );\n        }\n\n        if self.config.is_some() {\n            return Err(anyhow!(","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/astral-sh/uv/blob/f1a42680ff5272232d65748acf338b19778dde24/crates/uv-cli/src/compat.rs#L93-L129","documentation":"pip-compile's `--client-cert` passes a TLS client certificate (mTLS) for authenticated registry access. uv has no per-call client-certificate option — its TLS configuration comes from `--cert`/`SSL_CERT_FILE` for CAs and does not support dedicated client certificates — so the compatibility validator returns an error rather than silently dropping your credential config.","triggerScenarios":"`uv pip compile --client-cert client.pem requirements.in` against a private index that requires mutual TLS. The sibling `--client-cert` on `uv pip sync` fails identically (compat.rs:231).","commonSituations":"Corporate Artifactory/Nexus registries behind mTLS; CI pipelines migrating from pip-tools where `PIP_CLIENT_CERT`/`--client-cert` was standard; scripts shared across pip and uv tooling.","solutions":["Remove `--client-cert` from the uv invocation.","For mTLS needs, front the registry with a TLS-terminating proxy and point uv at it, or perform that resolution step with a tool that supports client certificates.","Watch uv's TLS docs/changelog — dedicated client certificates are a known gap; subscribe to the tracking issue rather than working around silently."],"exampleFix":"# before\nuv pip compile --client-cert client.pem requirements.in\n\n# after (terminate mTLS at a proxy)\n# proxy presents client cert upstream, serves plain HTTPS to uv\nuv pip compile --index-url https://proxy.internal/simple requirements.in","handlingStrategy":"validation","validationCode":"def check_mtls_flags(argv: list[str]) -> None:\n    if any(a == \"--client-cert\" or a.startswith(\"--client-cert=\") for a in argv):\n        raise ValueError(\n            \"uv does not support client certificates; terminate mTLS at a proxy or use another tool for this step\"\n        )","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify registry TLS requirements before migrating mTLS pipelines to uv.","Centralize TLS termination (proxy or internal CA via --cert/SSL_CERT_FILE) so no tool needs client certs.","Watch uv release notes for client-certificate support before reintroducing the flag."],"tags":["cli","pip-tools","compatibility","mtls","network","compile"],"backgroundTag":null,"analyzedSha":"f1a42680ff5272232d65748acf338b19778dde24","analyzedAt":"2026-08-16T04:51:47.599Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}