{"id":"82317d15df161a6d","repo":"labstack/echo","slug":"errinvalidcertorkeytype","errorCode":"ErrInvalidCertOrKeyType","errorMessage":"invalid cert or key type, must be string or []byte","messagePattern":"invalid cert or key type, must be string or \\[\\]byte","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"httperror.go","lineNumber":34,"sourceCode":"\tErrForbidden                   = &httpError{http.StatusForbidden}             // 403\n\tErrNotFound                    = &httpError{http.StatusNotFound}              // 404\n\tErrMethodNotAllowed            = &httpError{http.StatusMethodNotAllowed}      // 405\n\tErrRequestTimeout              = &httpError{http.StatusRequestTimeout}        // 408\n\tErrStatusRequestEntityTooLarge = &httpError{http.StatusRequestEntityTooLarge} // 413\n\tErrUnsupportedMediaType        = &httpError{http.StatusUnsupportedMediaType}  // 415\n\tErrTooManyRequests             = &httpError{http.StatusTooManyRequests}       // 429\n\tErrInternalServerError         = &httpError{http.StatusInternalServerError}   // 500\n\tErrBadGateway                  = &httpError{http.StatusBadGateway}            // 502\n\tErrServiceUnavailable          = &httpError{http.StatusServiceUnavailable}    // 503\n)\n\n// The following errors fall into 500 (InternalServerError) category\nvar (\n\tErrValidatorNotRegistered = errors.New(\"validator not registered\")\n\tErrRendererNotRegistered  = errors.New(\"renderer not registered\")\n\tErrInvalidRedirectCode    = errors.New(\"invalid redirect status code\")\n\tErrCookieNotFound         = errors.New(\"cookie not found\")\n\tErrInvalidCertOrKeyType   = errors.New(\"invalid cert or key type, must be string or []byte\")\n\tErrInvalidListenerNetwork = errors.New(\"invalid listener network\")\n)\n\n// HTTPStatusCoder is an interface that errors can implement to produce status code for HTTP response\ntype HTTPStatusCoder interface {\n\tStatusCode() int\n}\n\n// StatusCode returns status code from err if it implements HTTPStatusCoder interface.\n// If err does not implement the interface, it returns 0.\nfunc StatusCode(err error) int {\n\tvar sc HTTPStatusCoder\n\tif errors.As(err, &sc) {\n\t\treturn sc.StatusCode()\n\t}\n\treturn 0\n}\n","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/labstack/echo/blob/05489dc1730161df26b72d1ae2a3ba6fb8178fc7/httperror.go#L16-L52","documentation":"ErrInvalidCertOrKeyType is returned by filepathOrContent (server.go) when a TLS certificate or key argument is neither a string (file path) nor []byte (raw content). The helper switches on the dynamic type to decide whether to read from the filesystem or use the bytes directly; any other type (int, *string, struct, etc.) is rejected.","triggerScenarios":"Configuring StartTLS / StartConfig with a TLS cert or key as a non-string/non-byte type, e.g. passing *string, an os.File, or a custom struct for the cert/key parameter.","commonSituations":"Loading cert content into a variable of the wrong type. Passing a *string (pointer) instead of string. Version upgrade where the API tightened type checking.","solutions":["Pass the cert/key as a filesystem path string or as raw []byte content","If you have a *string, dereference it: *certPath","If you have an os.File, read its contents into []byte first"],"exampleFix":"// before\nerr := e.StartTLS(\":443\", certFilePtr, keyFilePtr) // *string — error\n\n// after\nerr := e.StartTLS(\":443\", *certFilePtr, *keyFilePtr) // string — ok","handlingStrategy":"validation","validationCode":"// Validate cert/key type before starting TLS\nfunc validCertOrKey(v any) bool {\n    switch v.(type) {\n    case string, []byte: return true\n    default: return false\n    }\n}\nif !validCertOrKey(cert) || !validCertOrKey(key) {\n    return errors.New(\"cert and key must be string or []byte\")\n}","typeGuard":"func isCertKeyType(v any) bool {\n    switch v.(type) {\n    case string, []byte: return true\n    default: return false\n    }\n}","tryCatchPattern":"if err := e.StartTLS(\":443\", cert, key); err != nil {\n    if errors.Is(err, echo.ErrInvalidCertOrKeyType) {\n        log.Fatal(\"cert/key must be a file path string or []byte content\")\n    }\n    return err\n}","preventionTips":["Pass cert/key as file path strings or raw []byte only","Dereference *string pointers before passing them as cert/key args","Read os.File contents into []byte before passing to TLS config"],"tags":["tls","https","cert","configuration","type-check"],"analyzedSha":"05489dc1730161df26b72d1ae2a3ba6fb8178fc7","analyzedAt":"2026-08-04T21:32:47.783Z","schemaVersion":2}