hatoo/oha · error

Failed to parse client_auth cert/key

Error message

Failed to parse client_auth cert/key

What it means

NativeTlsConnectors::new builds a client identity from the supplied client_auth (cert, key) bytes via native_tls::Identity::from_pkcs8 and panics with expect() when parsing fails. The faulting input is the client certificate/key pair: not PKCS#8 PEM, a mismatched cert/key pair, an encrypted key, or DER-encoded data.

Solutions

1. Ensure the key is unencrypted PKCS#8 PEM ('-----BEGIN PRIVATE KEY-----'); convert with 'openssl pkcs8 -topk8 -nocrypt -in key.pem'.
2. Verify the certificate and key are a matching pair (compare their public keys/moduli).
3. Concatenate cert and key is not required here — pass each as its own byte slice — but both must be valid PEM.
4. Re-export from the source keystore in PEM PKCS#8 form if the data is DER.

When it happens

Trigger: Thrown at src/tls_config.rs:108 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of hatoo/oha@4efba2d113 (2026-09-09). Data as JSON: /api/errors/0af92351b9c0f9f2. Report an issue: GitHub.

Appendix: source

Thrown at src/tls_config.rs:108

    ) -> Self {
        let new = |is_http2: bool| {
            let mut connector_builder = native_tls::TlsConnector::builder();

            if let Some(cacert_pem) = cacert_pem {
                let cert = native_tls::Certificate::from_pem(cacert_pem)
                    .expect("Failed to parse cacert_pem");
                connector_builder.add_root_certificate(cert);
            }

            if insecure {
                connector_builder
                    .danger_accept_invalid_certs(true)
                    .danger_accept_invalid_hostnames(true);
            }

            if let Some((cert, key)) = client_auth {
                let cert = native_tls::Identity::from_pkcs8(cert, key)
                    .expect("Failed to parse client_auth cert/key");
                connector_builder.identity(cert);
            }

            if is_http2 {
                connector_builder.request_alpns(&["h2"]);
            }

            connector_builder
                .build()
                .expect("Failed to build native_tls::TlsConnector")
                .into()
        };

        Self {
            no_alpn: new(false),
            alpn_h2: new(true),
        }
    }

View on GitHub (pinned to 4efba2d113)