{"record":{"id":"fd9a7bcaaf4e37a6","repo":"tsenart/vegeta","slug":"bad-certificate","errorCode":null,"errorMessage":"bad certificate","messagePattern":"bad certificate","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"attack.go","lineNumber":76,"sourceCode":"\tfs.Var(&opts.proxyHeaders, \"proxy-header\", \"Proxy CONNECT header\")\n\tfs.Var(&opts.laddr, \"laddr\", \"Local IP address\")\n\tfs.BoolVar(&opts.keepalive, \"keepalive\", true, \"Use persistent connections\")\n\tfs.StringVar(&opts.unixSocket, \"unix-socket\", \"\", \"Connect over a unix socket. This overrides the host address in target URLs\")\n\tfs.StringVar(&opts.promAddr, \"prometheus-addr\", \"\", \"Prometheus exporter listen address [empty = disabled]. Example: 0.0.0.0:8880\")\n\tfs.Var(&dnsTTLFlag{&opts.dnsTTL}, \"dns-ttl\", \"Cache DNS lookups for the given duration [-1 = disabled, 0 = forever]\")\n\tfs.BoolVar(&opts.sessionTickets, \"session-tickets\", false, \"Enable TLS session resumption using session tickets\")\n\tfs.Var(&connectToFlag{&opts.connectTo}, \"connect-to\", \"A mapping of (ip|host):port to use instead of a target URL's (ip|host):port. Can be repeated multiple times.\\nIdentical src:port with different dst:port will round-robin over the different dst:port pairs.\\nExample: google.com:80:localhost:6060\")\n\tsystemSpecificFlags(fs, opts)\n\n\treturn command{fs, func(args []string) error {\n\t\tfs.Parse(args)\n\t\treturn attack(opts)\n\t}}\n}\n\nvar (\n\terrZeroRate = errors.New(\"rate frequency and time unit must be bigger than zero\")\n\terrBadCert  = errors.New(\"bad certificate\")\n)\n\n// attackOpts aggregates the attack function command options\ntype attackOpts struct {\n\tname           string\n\ttargetsf       string\n\tformat         string\n\toutputf        string\n\tbodyf          string\n\tcertf          string\n\tkeyf           string\n\trootCerts      csl\n\thttp2          bool\n\th2c            bool\n\tinsecure       bool\n\tlazy           bool\n\tchunked        bool\n\tduration       time.Duration","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/tsenart/vegeta/blob/cf5811269046c672a604b1eb352204d30f16ae4a/attack.go#L58-L94","documentation":"errBadCert is returned by tlsConfig when the provided TLS certificate material cannot be loaded or parsed. It signals that the attacker's client TLS configuration is invalid, typically due to a malformed PEM file or mismatched key/cert pair.","triggerScenarios":"Passing a bad certificate/key path or content to vegeta attack's TLS options (e.g. -cert/-key flags), causing tlsConfig in attack.go to fail loading the X.509 keypair.","commonSituations":"Expired or corrupt certificate files, wrong file paths, a key that doesn't match the certificate, or passing a public cert where a keypair (cert+key) is required.","solutions":["Verify the cert and key files exist, are valid PEM, and form a matching pair (compare moduli or use `openssl x509`/`openssl rsa` checks).","Regenerate or re-export the certificate/key pair from your CA.","Test with `openssl x509 -in cert.pem -noout` and `openssl rsa -in key.pem -check` before running the attack."],"exampleFix":"// before\nvegeta attack -cert wrong.pem -key wrong.key ...\n// after\nvegeta attack -cert cert.pem -key key.pem ...","handlingStrategy":"validation","validationCode":"if _, err := tls.LoadX509KeyPair(certFile, keyFile); err != nil {\n    return fmt.Errorf(\"bad TLS material: %w\", err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate cert/key with openssl before deploying","Keep cert and key files together and version them as a pair","Check file readability/permissions of PEM files before the run"],"tags":["tls","certificates","configuration"],"backgroundTag":"tls-certificate-invalid","analyzedSha":"cf5811269046c672a604b1eb352204d30f16ae4a","analyzedAt":"2026-08-31T11:04:20.464Z","schemaVersion":2},"datasetVersion":"2026-09-01T08:17:40.651Z"}