grafana/k6 · error

failed to load the TLS certificate: %w

Error message

failed to load the TLS certificate: %w

What it means

tls.LoadX509KeyPair failed for the client certificate/key configured via K6_PROMETHEUS_RW_CLIENT_CERTIFICATE and K6_PROMETHEUS_RW_CLIENT_CERTIFICATE_KEY — files missing/unreadable, malformed PEM, or key mismatch. RemoteConfig wraps the load error.

Source

Thrown at internal/output/prometheusrw/remotewrite/config.go:135

			Username: conf.Username.String,
			Password: conf.Password.String,
		}
	}

	tlsMinVersion := uint16(tls.VersionTLS13)
	if conf.TLSMinVersion.Valid && conf.TLSMinVersion.String == "1.2" {
		tlsMinVersion = tls.VersionTLS12
	}

	hc.TLSConfig = &tls.Config{
		InsecureSkipVerify: conf.InsecureSkipTLSVerify.Bool, //nolint:gosec
		MinVersion:         tlsMinVersion,
	}

	if conf.ClientCertificate.Valid && conf.ClientCertificateKey.Valid {
		cert, err := tls.LoadX509KeyPair(conf.ClientCertificate.String, conf.ClientCertificateKey.String)
		if err != nil {
			return nil, fmt.Errorf("failed to load the TLS certificate: %w", err)
		}
		hc.TLSConfig.Certificates = []tls.Certificate{cert}
	}

	if isSigV4PartiallyConfigured(conf.SigV4Region, conf.SigV4AccessKey, conf.SigV4SecretKey) {
		return nil, errors.New(
			"sigv4 seems to be partially configured. All of " +
				"K6_PROMETHEUS_RW_SIGV4_REGION, K6_PROMETHEUS_RW_SIGV4_ACCESS_KEY, K6_PROMETHEUS_RW_SIGV4_SECRET_KEY " +
				"must all be set. Unset all to bypass sigv4",
		)
	}

	if conf.SigV4Region.Valid && conf.SigV4AccessKey.Valid && conf.SigV4SecretKey.Valid {
		hc.SigV4 = &sigv4.Config{
			Region:             conf.SigV4Region.String,
			AwsAccessKeyID:     conf.SigV4AccessKey.String,
			AwsSecretAccessKey: conf.SigV4SecretKey.String,
		}

View on GitHub (pinned to 01ffac6f24)

Solutions

1. Verify both certificate and key paths exist and are readable
2. Ensure the pair is a valid PEM certificate/key match
3. Regenerate the client certificate if corrupted

When it happens

Trigger: Thrown at internal/output/prometheusrw/remotewrite/config.go:135 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of grafana/k6@01ffac6f24 (2026-08-18). Data as JSON: /api/errors/56a074835042a711. Report an issue: GitHub.