labstack/echo · error

ErrInvalidCertOrKeyType

ErrInvalidCertOrKeyType

Error message

invalid cert or key type, must be string or []byte

What it means

ErrInvalidCertOrKeyType is returned by filepathOrContent (server.go) when a TLS certificate or key argument is neither a string (file path) nor []byte (raw content). The helper switches on the dynamic type to decide whether to read from the filesystem or use the bytes directly; any other type (int, *string, struct, etc.) is rejected.

Source

Thrown at httperror.go:34

	ErrForbidden                   = &httpError{http.StatusForbidden}             // 403
	ErrNotFound                    = &httpError{http.StatusNotFound}              // 404
	ErrMethodNotAllowed            = &httpError{http.StatusMethodNotAllowed}      // 405
	ErrRequestTimeout              = &httpError{http.StatusRequestTimeout}        // 408
	ErrStatusRequestEntityTooLarge = &httpError{http.StatusRequestEntityTooLarge} // 413
	ErrUnsupportedMediaType        = &httpError{http.StatusUnsupportedMediaType}  // 415
	ErrTooManyRequests             = &httpError{http.StatusTooManyRequests}       // 429
	ErrInternalServerError         = &httpError{http.StatusInternalServerError}   // 500
	ErrBadGateway                  = &httpError{http.StatusBadGateway}            // 502
	ErrServiceUnavailable          = &httpError{http.StatusServiceUnavailable}    // 503
)

// The following errors fall into 500 (InternalServerError) category
var (
	ErrValidatorNotRegistered = errors.New("validator not registered")
	ErrRendererNotRegistered  = errors.New("renderer not registered")
	ErrInvalidRedirectCode    = errors.New("invalid redirect status code")
	ErrCookieNotFound         = errors.New("cookie not found")
	ErrInvalidCertOrKeyType   = errors.New("invalid cert or key type, must be string or []byte")
	ErrInvalidListenerNetwork = errors.New("invalid listener network")
)

// HTTPStatusCoder is an interface that errors can implement to produce status code for HTTP response
type HTTPStatusCoder interface {
	StatusCode() int
}

// StatusCode returns status code from err if it implements HTTPStatusCoder interface.
// If err does not implement the interface, it returns 0.
func StatusCode(err error) int {
	var sc HTTPStatusCoder
	if errors.As(err, &sc) {
		return sc.StatusCode()
	}
	return 0
}

View on GitHub (pinned to 05489dc173)

Solutions

1. Pass the cert/key as a filesystem path string or as raw []byte content
2. If you have a *string, dereference it: *certPath
3. If you have an os.File, read its contents into []byte first

Example fix

// before
err := e.StartTLS(":443", certFilePtr, keyFilePtr) // *string — error

// after
err := e.StartTLS(":443", *certFilePtr, *keyFilePtr) // string — ok

// Validate cert/key type before starting TLS
func validCertOrKey(v any) bool {
    switch v.(type) {
    case string, []byte: return true
    default: return false
    }
}
if !validCertOrKey(cert) || !validCertOrKey(key) {
    return errors.New("cert and key must be string or []byte")
}

func isCertKeyType(v any) bool {
    switch v.(type) {
    case string, []byte: return true
    default: return false
    }
}

if err := e.StartTLS(":443", cert, key); err != nil {
    if errors.Is(err, echo.ErrInvalidCertOrKeyType) {
        log.Fatal("cert/key must be a file path string or []byte content")
    }
    return err
}

When it happens

Trigger: Configuring StartTLS / StartConfig with a TLS cert or key as a non-string/non-byte type, e.g. passing *string, an os.File, or a custom struct for the cert/key parameter.

Common situations: Loading cert content into a variable of the wrong type. Passing a *string (pointer) instead of string. Version upgrade where the API tightened type checking.

Related errors

• ErrValidatorNotRegistered
• ErrInvalidListenerNetwork
• echo basic-auth middleware requires a validator function
• echo body-dump middleware requires a handler function
• invalid gzip level

AI-assisted analysis of labstack/echo@05489dc173 (2026-08-04). Data as JSON: /data/errors/82317d15df161a6d.json. Report an issue: GitHub.