gofr-dev/gofr · critical

invalid key file

Error message

invalid key file

What it means

errInvalidKeyFile is declared in pkg/gofr/http_server.go and returned by validateCertificateAndKeyFiles when the configured TLS private key file does not exist. Like the cert check, gofr validates the key file at startup so misconfigured TLS fails fast with a clear error.

Source

Thrown at pkg/gofr/http_server.go:33

	"gofr.dev/pkg/gofr/http/middleware"
	"gofr.dev/pkg/gofr/logging"
	"gofr.dev/pkg/gofr/websocket"
)

type httpServer struct {
	router      *gofrHTTP.Router
	port        int
	ws          *websocket.Manager
	srvMu       sync.Mutex // guards srv, which run() writes on the serve goroutine and Shutdown() reads on the caller goroutine
	srv         *http.Server
	certFile    string
	keyFile     string
	staticFiles map[string]string
}

var (
	errInvalidCertificateFile = errors.New("invalid certificate file")
	errInvalidKeyFile         = errors.New("invalid key file")
)

// logRouterChoice reports the route matcher the router resolved to.
//
// It stays quiet for the default, which every service gets and nobody needs told
// about. It speaks up for the two cases that are worth a line: the opt-in matcher
// being active, and a GOFR_ROUTER value that was not understood — the latter
// falls back to mux, which looks exactly like never having set the variable, so a
// typo would otherwise cost the opt-in with nothing said.
func logRouterChoice(logger logging.Logger, r *gofrHTTP.Router) {
	requested := os.Getenv(gofrHTTP.RouterEnvVar)
	if requested == "" {
		return
	}

	if !strings.EqualFold(requested, r.Matcher()) {
		logger.Warnf("unrecognized %s value %q, using the %q router; valid values are %q and %q",
			gofrHTTP.RouterEnvVar, requested, r.Matcher(), gofrHTTP.MatcherMux, gofrHTTP.MatcherTrie)

View on GitHub (pinned to 187eb24962)

Solutions

1. Confirm the key path exists from the process's working directory (ls -l <key path>)
2. Correct the HTTPS_KEY_FILE/config value to the real key location
3. Mount the key secret/volume into the container and re-deploy
4. Check you are not confusing the cert and key paths — they are validated in that order

Example fix

// before
export HTTPS_KEY_FILE=/etc/ssl/gofr/server.key  # not mounted
// after
# k8s: mount secret 'tls-key' at /etc/ssl/gofr/
export HTTPS_KEY_FILE=/etc/ssl/gofr/tls.key
ls -l /etc/ssl/gofr/tls.key

func checkKey(path string) error {
    if path == "" {
        return errors.New("key path not configured")
    }
    if _, err := os.Stat(path); err != nil {
        return fmt.Errorf("key file missing: %w", err)
    }
    return nil
}

func isInvalidKey(err error) bool {
    return errors.Is(err, errInvalidKeyFile)
}

if err := server.Run(); err != nil {
    if errors.Is(err, errInvalidKeyFile) {
        log.Fatalf("TLS key missing: %v", err)
    }
    return err
}

When it happens

Trigger: Starting the gofr server with a key-file path (HTTPS_KEY_FILE or config equivalent) where os.Stat returns IsNotExist; validateCertificateAndKeyFiles wraps the missing path with errInvalidKeyFile as '%w : %v'.

Common situations: Key stored separately from the cert (e.g. in a different K8s secret) and only the cert mounted; key regenerated with a new filename but config not updated; permissions preventing traversal is different, but a wrong path yields exactly this error.

Related errors

• invalid certificate file
• %w : %v
• failed to append CA certificate
• failed to read CA certificate from %s: %w
• %w: deleting document: %w

AI-assisted analysis of gofr-dev/gofr@187eb24962 (2026-09-01). Data as JSON: /api/errors/1d98dd887976cce3. Report an issue: GitHub.