if a client certification option is provided, then all three

Error message

if a client certification option is provided, then all three must be provided

What it means

ReplaceInteractshMarkers asks the configured interactsh client (source.NewURLWithData) to mint an OAST URL for every interactsh marker found in template text. If the client cannot allocate one - server unreachable, error response, or client stopped - value rendering fails with this wrapped error, across every protocol that prepares template values.

Source

Thrown at internal/runner/options.go:185

		return errors.New("both follow redirects and disable redirects specified")
	}
	// loading the proxy server list from file or cli and test the connectivity
	if err := loadProxyServers(options); err != nil {
		return err
	}
	if options.Validate {
		validateTemplatePaths(options.Logger, config.DefaultConfig.TemplatesDirectory, options.Templates, options.Workflows)
	}
	if options.DAST {
		if err := validateDASTOptions(options); err != nil {
			return err
		}
	}

	// Verify if any of the client certificate options were set since it requires all three to work properly
	if options.HasClientCertificates() {
		if generic.EqualsAny("", options.ClientCertFile, options.ClientKeyFile, options.ClientCAFile) {
			return errors.New("if a client certification option is provided, then all three must be provided")
		}
		validateCertificatePaths(options.Logger, options.ClientCertFile, options.ClientKeyFile, options.ClientCAFile)
	}
	// Verify AWS secrets are passed if a S3 template bucket is passed
	if options.AwsBucketName != "" && options.UpdateTemplates && !options.AwsTemplateDisableDownload {
		missing := validateMissingS3Options(options)
		if missing != nil {
			return fmt.Errorf("aws s3 bucket details are missing. Please provide %s", strings.Join(missing, ","))
		}
	}

	// Verify Azure connection configuration is passed if the Azure template bucket is passed
	if options.AzureContainerName != "" && options.UpdateTemplates && !options.AzureTemplateDisableDownload {
		missing := validateMissingAzureOptions(options)
		if missing != nil {
			return fmt.Errorf("azure connection details are missing. Please provide %s", strings.Join(missing, ","))
		}
	}

View on GitHub (pinned to 265b3a3dec)

Solutions

Verify the OAST server is reachable (curl / DNS check) from the scanning host
Retry the scan - allocation failures are frequently transient
Point -interactsh-server at a healthy or self-hosted instance
If out-of-band detection is not needed, disable it with -no-interactsh

Example fix

# before
nuclei -t tpl.yaml   # default OAST endpoint failing
# after
nuclei -t tpl.yaml -interactsh-server https://oast.mycorp.com

Defensive patterns

Strategy: retry

Try / catch

result, err := render.ReplaceInteractshMarkers(text, src, urls)
if err != nil && strings.Contains(err.Error(), "replace interactsh marker") {
    // OAST allocation failure: back off once, then surface
    time.Sleep(2 * time.Second)
    result, err = render.ReplaceInteractshMarkers(text, src, urls)
}
if err != nil {
    return err
}

Prevention

Health-check the OAST server before large scans
Self-host interactsh for reliability
Disable OOB (-no-interactsh) for templates without markers

When it happens

Trigger: A template containing {{interactsh-url}} style markers while the OAST server (default public instance or the -interactsh-server target) is unreachable, rate-limits, or errors during URL registration.

Common situations: Corporate egress blocking OAST domains; a self-hosted interactsh server that is down; transient public-server outages during large scans.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/6daff030cdd375dd. Report an issue: GitHub.