go-task/task · error

task: --cert and --cert-key must be provided together

Error message

task: --cert and --cert-key must be provided together

What it means

Validate in internal/flags requires mutual TLS credentials to be supplied as a pair. --cert without --cert-key, or vice versa, is rejected because a TLS client config cannot be built from a half-specified certificate/key set.

Source

Thrown at internal/flags/flags.go:246

	if List && ListAll {
		return errors.New("task: cannot use --list and --list-all at the same time")
	}

	if ListJson && !List && !ListAll {
		return errors.New("task: --json only applies to --list or --list-all")
	}

	if NoStatus && !ListJson {
		return errors.New("task: --no-status only applies to --json with --list or --list-all")
	}

	if Nested && !ListJson {
		return errors.New("task: --nested only applies to --json with --list or --list-all")
	}

	// Validate certificate flags
	if (Cert != "" && CertKey == "") || (Cert == "" && CertKey != "") {
		return errors.New("task: --cert and --cert-key must be provided together")
	}

	return nil
}

// WithFlags is a special internal functional option that is used to pass flags
// from the CLI into any constructor that accepts functional options.
func WithFlags() task.ExecutorOption {
	return &flagsOption{}
}

type flagsOption struct{}

func (o *flagsOption) ApplyToExecutor(e *task.Executor) {
	// Set the sorter
	var sorter sort.Sorter
	switch TaskSort {
	case "none":

View on GitHub (pinned to 385e5ad92a)

Solutions

1. Provide both flags together: --cert <certfile> --cert-key <keyfile>
2. Check that neither value is empty after variable/env expansion
3. Remove both flags if TLS client auth is not needed

Example fix

// before
task --cert ./client.crt
// after
task --cert ./client.crt --cert-key ./client.key

if (cert != "") != (certKey != "") {
    return fmt.Errorf("--cert and --cert-key must be provided together")
}

func certPairComplete(cert, certKey string) bool {
    return (cert == "") == (certKey == "")
}

When it happens

Trigger: Passing only --cert, or only --cert-key, to the task binary (or setting Cert/CertKey fields inconsistently via WithFlags).

Common situations: Users configuring remote Task (TLS) copy a server cert path but forget the private key, or an env/secret substitution leaves one of the two values empty.

Related errors

• task: --nested only applies to --json with --list or --list-
• task: You can't set both --download and --offline flags
• task: You can't set both --download and --clear-cache flags
• task: You can't set both --global and --dir
• task: You can't set --output-group-begin without --output=gr

AI-assisted analysis of go-task/task@385e5ad92a (2026-09-05). Data as JSON: /api/errors/5038b4b48bf72f52. Report an issue: GitHub.