grafana/k6 · error

failed to load client certificate: %w

Error message

failed to load client certificate: %w

What it means

When client certificate options are configured, buildTLSConfig calls tls.LoadX509KeyPair with the client cert and key paths; this error wraps that failure — files unreadable, not PEM-encoded, or cert/key mismatch. The mTLS configuration is invalid so the OpenTelemetry exporter is not created.

Source

Thrown at internal/output/opentelemetry/tls.go:47

		b, err := os.ReadFile(certPath.String) //nolint:forbidigo
		if err != nil {
			return nil, fmt.Errorf("failed to read root certificate from %q: %w", certPath.String, err)
		}

		cp := x509.NewCertPool()
		if ok := cp.AppendCertsFromPEM(b); !ok {
			return nil, errors.New("failed to append root certificate to the pool")
		}

		tlsConfig.RootCAs = cp
		set = true
	}

	// Load the client certificate
	if clientCertPath.Valid {
		cert, err := tls.LoadX509KeyPair(clientCertPath.String, clientKeyPath.String)
		if err != nil {
			return nil, fmt.Errorf("failed to load client certificate: %w", err)
		}

		tlsConfig.Certificates = []tls.Certificate{cert}
		set = true
	}

	if !set {
		return nil, nil //nolint:nilnil // no TLS config set
	}

	return tlsConfig, nil
}

View on GitHub (pinned to 01ffac6f24)

Solutions

1. Check that both cert and key file paths exist and are readable
2. Ensure the certificate and key are a valid PEM pair
3. Regenerate the client certificate/key if corrupted

When it happens

Trigger: Thrown at internal/output/opentelemetry/tls.go:47 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of grafana/k6@01ffac6f24 (2026-08-18). Data as JSON: /api/errors/1109906025469559. Report an issue: GitHub.