facebook/docusaurus · error · Error

The certificate path=${cert.path} and key path=${key.path} d

Error message

The certificate path=${cert.path} and key path=${key.path} do not match.

What it means

Thrown by `validateKeyAndCerts` when both the certificate and the private key parse successfully but their embedded public keys do not match — i.e. the cert and key are not a pair. This catches the common mistake of mixing files from different cert generations.

Source

Thrown at packages/docusaurus/src/webpack/utils/getHttpsConfig.ts:41

  } catch (error) {
    throw new Error(
      logger.interpolate`The certificate path=${cert.path} is invalid.`,
      {cause: error},
    );
  }

  let keyPublicKey: crypto.KeyObject;
  try {
    keyPublicKey = crypto.createPublicKey(crypto.createPrivateKey(key.content));
  } catch (error) {
    throw new Error(
      logger.interpolate`The certificate key path=${key.path} is invalid.`,
      {cause: error},
    );
  }

  if (!certPublicKey.equals(keyPublicKey)) {
    throw new Error(
      logger.interpolate`The certificate path=${cert.path} and key path=${key.path} do not match.`,
    );
  }
}

type HttpsConfigOptions = {
  https: boolean;
  sslCert: string;
  sslKey: string;
};

function getExplicitHttps(
  options: Partial<HttpsConfigOptions>,
): boolean | undefined {
  return (
    options.https ??
    (typeof process.env.DOCUSAURUS_HTTPS !== 'undefined'
      ? process.env.DOCUSAURUS_HTTPS == 'true'

View on GitHub (pinned to 3f483e80e3)

Solutions

Regenerate a matched cert+key pair together (`mkcert localhost` produces both).
Verify the match: `diff <(openssl x509 -in cert.pem -pubkey -noout) <(openssl pkey -in key.pem -pubout)`.
Point `sslCert` and `sslKey` at the corresponding files from the same generation.

Example fix

# before (mismatched pair from two runs)
sslCert: ./cert-run-1.pem
sslKey:  ./key-run-2.pem
# after (regenerate together)
#   mkcert localhost
sslCert: ./localhost.pem
sslKey:  ./localhost-key.pem

Defensive patterns

Strategy: validation

Validate before calling

const crypto = require('crypto');
const fs = require('fs');
function certMatchesKey(certPath: string, keyPath: string) {
  const cert = new crypto.X509Certificate(fs.readFileSync(certPath));
  const key = crypto.createPublicKey(crypto.createPrivateKey(fs.readFileSync(keyPath)));
  return cert.publicKey.equals(key);
}

Try / catch

try {
  validateKeyAndCerts({cert, key});
} catch (e) {
  if (/do not match/.test(e.message)) {
    console.error('Cert and key are not a pair — regenerate together');
  }
  throw e;
}

Prevention

Generate cert+key as a pair (`mkcert localhost`) and never mix files from different runs.
Verify the match with `diff <(openssl x509 -in cert.pem -pubkey -noout) <(openssl pkey -in key.pem -pubout)`.
Store the pair together (e.g. in one secrets folder) and reference by absolute paths.

When it happens

Trigger: Providing a cert and key that were generated separately and don't correspond. After both parse, the check `!certPublicKey.equals(keyPublicKey)` at getHttpsConfig.ts:40-45 fires.

Common situations: Regenerating a cert and forgetting to update the key (or vice versa); mixing files from two `mkcert`/`openssl` runs; copying the wrong pair from a secrets folder.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of facebook/docusaurus@3f483e80e3 (2026-08-12). Data as JSON: /api/errors/91530d1530da467a. Report an issue: GitHub.