hyperledger/fabric · error

both Key and Certificate are required when using mutual TLS

Error message

both Key and Certificate are required when using mutual TLS

What it means

Returned by SecureOptions.ClientCertificate when mutual TLS is requested but either Key or Certificate bytes are nil. Building a tls.Certificate requires both halves of the keypair, so the guard rejects the incomplete SecureOptions.

Source

Thrown at internal/pkg/comm/config.go:261

			return nil, errors.WithMessage(err, "failed to load client certificate")
		}
		tlsConfig.Certificates = append(tlsConfig.Certificates, cert)
	}

	if so.TimeShift > 0 {
		tlsConfig.Time = func() time.Time {
			return time.Now().Add((-1) * so.TimeShift)
		}
	}

	return tlsConfig, nil
}

// ClientCertificate returns the client certificate that will be used
// for mutual TLS.
func (so SecureOptions) ClientCertificate() (tls.Certificate, error) {
	if so.Key == nil || so.Certificate == nil {
		return tls.Certificate{}, errors.New("both Key and Certificate are required when using mutual TLS")
	}
	cert, err := tls.X509KeyPair(so.Certificate, so.Key)
	if err != nil {
		return tls.Certificate{}, errors.WithMessage(err, "failed to create key pair")
	}
	return cert, nil
}

// KeepaliveOptions is used to set the gRPC keepalive settings for both
// clients and servers
type KeepaliveOptions struct {
	// ClientInterval is the duration after which if the client does not see
	// any activity from the server it pings the server to see if it is alive
	ClientInterval time.Duration
	// ClientTimeout is the duration the client waits for a response
	// from the server after sending a ping before closing the connection
	ClientTimeout time.Duration
	// ServerInterval is the duration after which if the server does not see

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Provide both peer.tls.clientKey.file and peer.tls.clientCert.file
2. Ensure neither config path is empty when mutual TLS is required

When it happens

Trigger: Thrown at internal/pkg/comm/config.go:261 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/eccb15c9ec860037. Report an issue: GitHub.