--http-client-tls-key must be specified with --http-client-t

Error message

--http-client-tls-key must be specified with --http-client-tls-cert

What it means

nsqadmin can authenticate to nsqd/nsqlookupd with a client certificate when those servers require mTLS. The two options form a pair: opts.HTTPClientTLSCert is set while opts.HTTPClientTLSKey is empty, so tls.LoadX509KeyPair could never be called and New() fails fast with a pointer to the missing flag.

Source

Thrown at nsqadmin/nsqadmin.go:53

	if opts.Logger == nil {
		opts.Logger = log.New(os.Stderr, opts.LogPrefix, log.Ldate|log.Ltime|log.Lmicroseconds)
	}

	n := &NSQAdmin{
		notifications: make(chan *AdminAction),
	}
	n.swapOpts(opts)

	if len(opts.NSQDHTTPAddresses) == 0 && len(opts.NSQLookupdHTTPAddresses) == 0 {
		return nil, errors.New("--nsqd-http-address or --lookupd-http-address required")
	}

	if len(opts.NSQDHTTPAddresses) != 0 && len(opts.NSQLookupdHTTPAddresses) != 0 {
		return nil, errors.New("use --nsqd-http-address or --lookupd-http-address not both")
	}

	if opts.HTTPClientTLSCert != "" && opts.HTTPClientTLSKey == "" {
		return nil, errors.New("--http-client-tls-key must be specified with --http-client-tls-cert")
	}

	if opts.HTTPClientTLSKey != "" && opts.HTTPClientTLSCert == "" {
		return nil, errors.New("--http-client-tls-cert must be specified with --http-client-tls-key")
	}

	n.httpClientTLSConfig = &tls.Config{
		InsecureSkipVerify: opts.HTTPClientTLSInsecureSkipVerify,
	}
	if opts.HTTPClientTLSCert != "" && opts.HTTPClientTLSKey != "" {
		cert, err := tls.LoadX509KeyPair(opts.HTTPClientTLSCert, opts.HTTPClientTLSKey)
		if err != nil {
			return nil, fmt.Errorf("failed to LoadX509KeyPair %s, %s - %s",
				opts.HTTPClientTLSCert, opts.HTTPClientTLSKey, err)
		}
		n.httpClientTLSConfig.Certificates = []tls.Certificate{cert}
	}
	if opts.HTTPClientTLSRootCAFile != "" {

View on GitHub (pinned to 85cf10c09c)

Solutions

Add the matching key: --http-client-tls-key=/path/key.pem.
Verify both paths point to a valid PEM pair (openssl x509 -in cert.pem -noout / openssl rsa -in key.pem -check).
If the CA rather than client identity was intended, use --http-client-tls-ca-cert instead of the cert flag.

Example fix

# before
nsqadmin --lookupd-http-address=10.0.0.2:4161 --http-client-tls-cert=/etc/nsq/client.pem
# after
nsqadmin --lookupd-http-address=10.0.0.2:4161 --http-client-tls-cert=/etc/nsq/client.pem --http-client-tls-key=/etc/nsq/client.key

Defensive patterns

Strategy: validation

Validate before calling

func validateClientTLSPair(cert, key string) error {
	if (cert == "") != (key == "") {
		return errors.New("--http-client-tls-cert and --http-client-tls-key must be set together")
	}
	return nil
}

Prevention

Store cert and key as one secret object and template both flags from it, so they are always emitted together.
Add a preflight check that both files exist before starting nsqadmin.

When it happens

Trigger: Launching nsqadmin with --http-client-tls-cert=/path/cert.pem but no --http-client-tls-key. The check is purely on empty-string flags and runs before any file is opened, so a wrong path does NOT trigger this error (that surfaces later as a LoadX509KeyPair failure).

Common situations: Cert and key concatenated into one PEM and only the cert flag set; copy-pasting only one line of a two-line TLS config; key managed by a secret store that failed to inject its flag.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of nsqio/nsq@85cf10c09c (2026-08-16). Data as JSON: /api/errors/13663d2242fef570. Report an issue: GitHub.