{"record":{"id":"fa7bb06495319d3d","repo":"thanos-io/thanos","slug":"unable-to-use-specified-client-cert-s-key-s","errorCode":null,"errorMessage":"unable to use specified client cert (%s) & key (%s): %s","messagePattern":"unable to use specified client cert \\((.+?)\\) & key \\((.+?)\\): (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/exthttp/tlsconfig.go","lineNumber":84,"sourceCode":"\t}\n\treturn data, nil\n}\n\n// updateRootCA parses the given byte slice as a series of PEM encoded certificates and updates tls.Config.RootCAs.\nfunc updateRootCA(cfg *tls.Config, b []byte) bool {\n\tcaCertPool := x509.NewCertPool()\n\tif !caCertPool.AppendCertsFromPEM(b) {\n\t\treturn false\n\t}\n\tcfg.RootCAs = caCertPool\n\treturn true\n}\n\n// getClientCertificate reads the pair of client cert and key from disk and returns a tls.Certificate.\nfunc (c *TLSConfig) getClientCertificate(*tls.CertificateRequestInfo) (*tls.Certificate, error) {\n\tcert, err := tls.LoadX509KeyPair(c.CertFile, c.KeyFile)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to use specified client cert (%s) & key (%s): %s\", c.CertFile, c.KeyFile, err)\n\t}\n\treturn &cert, nil\n}\n","sourceCodeStart":66,"sourceCodeEnd":88,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/pkg/exthttp/tlsconfig.go#L66-L88","documentation":"getClientCertificate fails because tls.LoadX509KeyPair cannot load the configured client cert/key pair — files missing, unreadable, malformed, or not matching as a pair. NewTLSConfig surfaces it during config construction.","triggerScenarios":"Thrown at pkg/exthttp/tlsconfig.go:84 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify both cert and key files exist, are readable, and are valid PEM.","Ensure cert and key match as a pair.","Reissue the certificate if expired or mismatched."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}