{"record":{"id":"fd3b99403e9c6b7c","repo":"thanos-io/thanos","slug":"server-credentials","errorCode":null,"errorMessage":"server credentials","messagePattern":"server credentials","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/tls/options.go","lineNumber":66,"sourceCode":"\t\tMinVersion: minTlsVersion,\n\t}\n\n\tcipherSuiteIDs, err := getCipherSuiteIDs(ciphers)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\ttlsCfg.CipherSuites = cipherSuiteIDs\n\n\tcurveIDs, err := getCurveIDs(curves)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\ttlsCfg.CurvePreferences = curveIDs\n\n\t// Certificate is loaded during server startup to check for any errors.\n\tcertificate, err := tls.LoadX509KeyPair(certPath, keyPath)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"server credentials\")\n\t}\n\n\tmngr := &serverTLSManager{\n\t\tsrvCertPath: certPath,\n\t\tsrvKeyPath:  keyPath,\n\t\tsrvCert:     &certificate,\n\t}\n\n\ttlsCfg.GetCertificate = mngr.getCertificate\n\n\tif clientCA != \"\" {\n\t\tcaPEM, err := os.ReadFile(filepath.Clean(clientCA))\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrap(err, \"reading client CA\")\n\t\t}\n\n\t\tcertPool := x509.NewCertPool()\n\t\tif !certPool.AppendCertsFromPEM(caPEM) {","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/pkg/tls/options.go#L48-L84","documentation":"NewServerConfig wraps a failure from tls.LoadX509KeyPair with the message 'server credentials'. This means the server certificate/key files could not be loaded — unreadable files, invalid PEM data, or a cert/key mismatch.","triggerScenarios":"tls.LoadX509KeyPair(certPath, keyPath) fails during NewServerConfig because a file is missing/unreadable, PEM blocks are invalid, or the private key does not match the certificate.","commonSituations":"Wrong file paths or missing secret mounts; concatenated or garbled PEM files; key/cert pair from different issuers after rotation; files without read permission for the process user.","solutions":["Verify both paths exist and are readable by the process: 'openssl x509 -in server.crt -noout' and 'openssl rsa -in server.key -check'","Confirm cert and key match: compare 'openssl x509 -noout -modulus' and 'openssl rsa -noout -modulus' output","Re-export the Kubernetes secret / re-copy the files if contents are corrupt","Check file permissions and mount paths match what the flags point to"],"exampleFix":"// before (mismatched pair)\n--cert=server-new.crt --key=server-old.key\n// after\n--cert=server-new.crt --key=server-new.key","handlingStrategy":"validation","validationCode":"// Validate pair before starting the server\nif _, err := tls.LoadX509KeyPair(certPath, keyPath); err != nil {\n    return fmt.Errorf(\"invalid server keypair: %w\", err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check cert/key modulus match after every rotation","Ensure secret mounts land at the exact flagged paths","Verify PEM formatting (full BEGIN/END blocks) when concatenating files"],"tags":["tls","certificates","configuration","startup"],"backgroundTag":"file-read-failed","analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}