nautechsystems/nautilus_trader · error · anyhow::Error

Client certificate or private key missing in {} but client a

Error message

Client certificate or private key missing in {} but client auth required

What it means

When building the TLS client config from a certs directory, if the directory contains a CA but no client certificate + private key pair, and require_client_auth is true, the function bails: mutual TLS cannot proceed without a client identity.

Source

Thrown at crates/network/src/tls.rs:175

        None
    };

    for (path, certs) in all_certs {
        for cert in certs {
            if let Err(e) = root_store.add(cert) {
                log::warn!("Invalid certificate in {}: {e}", path.display());
            }
        }
    }

    let builder = rustls::ClientConfig::builder().with_root_certificates(root_store);

    if let (Some(cert), Some(key)) = (client_cert, client_key) {
        return Ok(builder.with_client_auth_cert(cert, key)?);
    }

    if require_client_auth {
        anyhow::bail!(
            "Client certificate or private key missing in {} but client auth required",
            certs_dir.display(),
        );
    }

    log::debug!(
        "No TLS client certificate/key pair found in {}; proceeding without client authentication",
        certs_dir.display(),
    );

    Ok(builder.with_no_client_auth())
}

fn load_private_key(path: &Path) -> anyhow::Result<PrivateKeyDer<'static>> {
    let file = File::open(path)?;
    if let Some(key) = PrivatePkcs8KeyDer::pem_reader_iter(file).find_map(Result::ok) {
        return Ok(key.into());
    }

View on GitHub (pinned to 18893faf8b)

Solutions

1. Place both the client certificate and its private key PEM files in the certs directory.
2. Check the server's mTLS requirement: if client auth is not actually required, disable require_client_auth.
3. Verify the loader recognizes your file names/formats (PEM); confirm both cert and key are found by listing the directory contents.
4. Ensure secret-manager mounts include both client cert and key files.

Example fix

// before
/etc/certs/ca.pem                  # only CA, server requires mTLS
// after
/etc/certs/ca.pem
/etc/certs/client.pem              # client certificate
/etc/certs/client.key              # client private key

// Rust: ensure client cert+key exist when mTLS required
let dir = std::path::Path::new(certs_dir);
let has_cert = dir.read_dir()?.flatten().any(|e| e.path().extension().map_or(false, |x| x == "pem"));
if require_client_auth && !has_cert {
    return Err(anyhow::anyhow!("mTLS requires client cert+key in {}", certs_dir.display()));
}

let tls_cfg = create_tls_config_from_certs_dir(certs_dir, require_client_auth)
    .map_err(|e| { log::error!("mtls setup failed: {e}"); e })?;

When it happens

Trigger: connect_url with client-auth-required TLS against a certs directory that has only the CA (or only one of cert/key present), while the server demands client certificates.

Common situations: Server configured with client auth (mutual TLS) but client cert directory only contains the server CA; cert and key files named unexpectedly so the loader doesn't recognize them; partial secret mount missing client.pem or client.key.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Certificate path is not a directory: {}
• Invalid config type for AxExecutionClientFactory. Expected A
• Invalid factory address for DEX {name} on chain {chain} for
• heartbeat_secs must be positive when set
• Invalid price_match value: {s:?}

AI-assisted analysis of nautechsystems/nautilus_trader@18893faf8b (2026-09-08). Data as JSON: /api/errors/6fd4989b509feb30. Report an issue: GitHub.