{"id":"1fdecdf23c500445","repo":"pypa/pip","slug":"could-not-find-the-tls-key-file-invalid-path-co","errorCode":null,"errorMessage":"Could not find the TLS key file, invalid path: {conn.key_file}","messagePattern":"Could not find the TLS key file, invalid path: (.+?)","errorType":"exception","errorClass":"OSError","httpStatus":null,"severity":"error","filePath":"src/pip/_vendor/requests/adapters.py","lineNumber":361,"sourceCode":"        else:\n            conn.cert_reqs = \"CERT_NONE\"\n            conn.ca_certs = None\n            conn.ca_cert_dir = None\n\n        if cert:\n            if not isinstance(cert, basestring):\n                conn.cert_file = cert[0]\n                conn.key_file = cert[1]\n            else:\n                conn.cert_file = cert\n                conn.key_file = None\n            if conn.cert_file and not os.path.exists(conn.cert_file):\n                raise OSError(\n                    f\"Could not find the TLS certificate file, \"\n                    f\"invalid path: {conn.cert_file}\"\n                )\n            if conn.key_file and not os.path.exists(conn.key_file):\n                raise OSError(\n                    f\"Could not find the TLS key file, invalid path: {conn.key_file}\"\n                )\n\n    def build_response(self, req: PreparedRequest, resp: Any) -> Response:\n        \"\"\"Builds a :class:`Response <requests.Response>` object from a urllib3\n        response. This should not be called from user code, and is only exposed\n        for use when subclassing the\n        :class:`HTTPAdapter <requests.adapters.HTTPAdapter>`\n\n        :param req: The :class:`PreparedRequest <PreparedRequest>` used to generate the response.\n        :param resp: The urllib3 response object.\n        :rtype: requests.Response\n        \"\"\"\n        assert _is_prepared(req)\n        response = Response()\n\n        # Fallback to None if there's no status_code, for whatever reason.\n        response.status_code = getattr(resp, \"status\", None)  # type: ignore[assignment]","sourceCodeStart":343,"sourceCodeEnd":379,"githubUrl":"https://github.com/pypa/pip/blob/d7d0d0a39494e28ec1c407bd0680e4a4d1067791/src/pip/_vendor/requests/adapters.py#L343-L379","documentation":"HTTPAdapter.cert_verify raises OSError when client-certificate authentication is requested with a cert tuple whose second element (the private key file path) does not exist. conn.key_file is checked with os.path.exists only when a separate key file is supplied.","triggerScenarios":"Calling requests with cert=('/path/client.crt','/path/client.key') where client.key is missing; a scalar cert string sets key_file=None and will not hit this path, so this is specific to the two-element tuple form.","commonSituations":"Key file not deployed alongside the cert; path typo for the key; permissions/mount issues in containers; key stored in a different directory than expected.","solutions":["Confirm the private key file exists at the given path and is readable.","Use an absolute path for the key file.","Ensure the key file is provisioned in the runtime (mount/secret).","If cert and key live in one PEM, pass a single string (cert='/path/combined.pem') instead of a tuple."],"exampleFix":"# before\nrequests.get(url, cert=('/etc/ssl/c.crt', '/wrong/client.key'))\n\n# after\nrequests.get(url, cert=('/etc/ssl/c.crt', '/etc/ssl/c.key'))","handlingStrategy":"validation","validationCode":"import os\nkey_path = cert[1] if isinstance(cert, (tuple, list)) and len(cert) == 2 else None\nif key_path and not os.path.exists(key_path):\n    raise FileNotFoundError(f'client key not found: {key_path}')\nrequests.get(url, cert=cert)","typeGuard":null,"tryCatchPattern":"try:\n    resp = requests.get(url, cert=cert)\nexcept OSError as e:\n    if 'TLS key file' in str(e):\n        raise RuntimeError(f'missing client key: {e}') from e\n    raise","preventionTips":["Pre-validate the key file path when passing a cert tuple.","Consider a combined PEM (single string) to avoid separate key management."],"tags":["requests","tls","mtls","certificates","config"],"analyzedSha":"d7d0d0a39494e28ec1c407bd0680e4a4d1067791","analyzedAt":"2026-08-04T20:55:04.259Z","schemaVersion":2}