probelabs/goreplay · error

Missing key of client certificate in kafka

Error message

Missing key of client certificate in kafka

What it means

NewTLSConfig rejects Kafka TLS setup when a client certificate file is given without its corresponding private key file: the pair is incomplete and tls.LoadX509KeyPair could never succeed, so it fails early with this error.

Source

Thrown at kafka.go:71

// KafkaMessage should contains catched request information that should be
// passed as Json to Apache Kafka.
type KafkaMessage struct {
	ReqURL     string            `json:"Req_URL"`
	ReqType    string            `json:"Req_Type"`
	ReqID      string            `json:"Req_ID"`
	ReqTs      string            `json:"Req_Ts"`
	ReqMethod  string            `json:"Req_Method"`
	ReqBody    string            `json:"Req_Body,omitempty"`
	ReqHeaders map[string]string `json:"Req_Headers,omitempty"`
}

// NewTLSConfig loads TLS certificates
func NewTLSConfig(clientCertFile, clientKeyFile, caCertFile string) (*tls.Config, error) {
	tlsConfig := tls.Config{}

	if clientCertFile != "" && clientKeyFile == "" {
		return &tlsConfig, errors.New("Missing key of client certificate in kafka")
	}
	if clientCertFile == "" && clientKeyFile != "" {
		return &tlsConfig, errors.New("missing TLS client certificate in kafka")
	}
	// Load client cert
	if (clientCertFile != "") && (clientKeyFile != "") {
		cert, err := tls.LoadX509KeyPair(clientCertFile, clientKeyFile)
		if err != nil {
			return &tlsConfig, err
		}
		tlsConfig.Certificates = []tls.Certificate{cert}
	}
	// Load CA cert
	if caCertFile != "" {
		caCert, err := ioutil.ReadFile(caCertFile)
		if err != nil {
			return &tlsConfig, err
		}

View on GitHub (pinned to 251e45abd2)

Solutions

1. Pass both client cert and key, e.g. --kafka TLS client-cert and client-key flags together
2. Omit the client cert entirely if mutual TLS is not required
3. Check config templating — the key file variable may be resolving to empty

When it happens

Trigger: Thrown at kafka.go:71 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of probelabs/goreplay@251e45abd2 (2026-09-02). Data as JSON: /api/errors/a25a08625106a7ff. Report an issue: GitHub.