{"id":"4a30b810daaf678e","repo":"gofiber/fiber","slug":"tls-cannot-load-tls-key-pair-from-certfile-q-and","errorCode":null,"errorMessage":"tls: cannot load TLS key pair from certFile=%q and keyFile=%q: %w","messagePattern":"tls: cannot load TLS key pair from certFile=%q and keyFile=%q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"listen.go","lineNumber":214,"sourceCode":"//\tapp.Listen(\":8080\")\n//\tapp.Listen(\"127.0.0.1:8080\")\n//\tapp.Listen(\":8080\", ListenConfig{EnablePrefork: true})\nfunc (app *App) Listen(addr string, config ...ListenConfig) error {\n\tcfg := listenConfigDefault(config...)\n\n\t// Configure TLS\n\tvar tlsConfig *tls.Config\n\tvar tlsHandler *TLSHandler\n\tif cfg.TLSConfig != nil {\n\t\ttlsConfig = cfg.TLSConfig.Clone()\n\t} else {\n\t\tswitch {\n\t\tcase cfg.AutoCertManager != nil && (cfg.CertFile != \"\" || cfg.CertKeyFile != \"\"):\n\t\t\treturn ErrAutoCertWithCertFile\n\t\tcase cfg.CertFile != \"\" && cfg.CertKeyFile != \"\":\n\t\t\tcert, err := tls.LoadX509KeyPair(cfg.CertFile, cfg.CertKeyFile)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"tls: cannot load TLS key pair from certFile=%q and keyFile=%q: %w\", cfg.CertFile, cfg.CertKeyFile, err)\n\t\t\t}\n\n\t\t\ttlsHandler = &TLSHandler{}\n\t\t\ttlsConfig = &tls.Config{\n\t\t\t\tMinVersion: cfg.TLSMinVersion,\n\t\t\t\tCertificates: []tls.Certificate{\n\t\t\t\t\tcert,\n\t\t\t\t},\n\t\t\t\tGetCertificate: tlsHandler.GetClientInfo,\n\t\t\t}\n\n\t\tcase cfg.AutoCertManager != nil:\n\t\t\ttlsConfig = &tls.Config{\n\t\t\t\tMinVersion:     cfg.TLSMinVersion,\n\t\t\t\tGetCertificate: cfg.AutoCertManager.GetCertificate,\n\t\t\t\tNextProtos:     []string{\"http/1.1\", \"acme-tls/1\"},\n\t\t\t}\n\t\tdefault:","sourceCodeStart":196,"sourceCodeEnd":232,"githubUrl":"https://github.com/gofiber/fiber/blob/9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c/listen.go#L196-L232","documentation":"Returned by App.Listen when tls.LoadX509KeyPair fails to load the TLS certificate and private key pair. This happens at server startup when both Config.CertFile and Config.CertKeyFile are set but the files are missing, unreadable, or do not form a valid X.509 key pair. The error includes both file paths and the underlying tls error.","triggerScenarios":"Calling app.Listen(\":443\", fiber.ListenConfig{CertFile: \"cert.pem\", CertKeyFile: \"key.pem\"}) where either file is missing, the key doesn't match the cert, the files are not PEM-encoded, or the process lacks read permission.","commonSituations":"Cert files not mounted into the container, paths relative to the wrong working directory, an expired/regenerated cert whose key wasn't updated in tandem, or permission issues on the secrets.","solutions":["Verify both paths exist and are readable: ls -l cert.pem key.pem.","Confirm cert and key match using openssl to compare the modulus of the cert and key.","Use absolute paths for the cert and key files in production.","Ensure PEM formatting (BEGIN/END CERTIFICATE and BEGIN/END PRIVATE KEY).","For auto-rotating certs, prefer AutoCertManager or a custom TLSConfig with GetCertificate."],"exampleFix":"// before\napp.Listen(\":443\", fiber.ListenConfig{\n    CertFile:    \"cert\",     // wrong/missing file\n    CertKeyFile: \"key\",\n})\n\n// after\napp.Listen(\":443\", fiber.ListenConfig{\n    CertFile:    \"/etc/tls/fullchain.pem\",\n    CertKeyFile: \"/etc/tls/privkey.pem\",\n})","handlingStrategy":"validation","validationCode":"// Validate the cert/key pair at startup before Listen\nif _, err := tls.LoadX509KeyPair(certFile, keyFile); err != nil {\n    log.Fatalf(\"invalid TLS key pair: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := app.Listen(\":443\", fiber.ListenConfig{\n    CertFile: certFile, CertKeyFile: keyFile,\n}); err != nil {\n    log.Fatalf(\"server stopped: %v\", err)\n}","preventionTips":["Verify cert and key files exist and are readable before boot.","Use absolute paths for TLS files in production.","Confirm cert and key match by comparing their modulus.","Use AutoCertManager or a GetCertificate hook for auto-rotation.","Ensure PEM formatting for both files."],"tags":["tls","ssl","certificate","startup","security","go"],"analyzedSha":"9a4c7e57fe0b080a04235d28a4b0d2b4b353d58c","analyzedAt":"2026-08-04T21:44:03.395Z","schemaVersion":2}