Hive client certificate and key must be configured together

Error message

Hive client certificate and key must be configured together

What it means

Mutual TLS client authentication requires both a client certificate and its private key. If exactly one of ClientCertPath / ClientKeyPath is provided, the driver cannot assemble a usable tls.X509KeyPair and fails validation. This is a paired-parameter completeness check.

Source

Thrown at agents/drivers/hive-go/config.go:1088

		certificates, err := loadTrustStore(
			trustStoreLocation,
			parameter(values, "truststorepassword"),
			parameter(values, "truststoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load Hive truststore: %w", err)
		}
		if customRoots == nil {
			customRoots = x509.NewCertPool()
		}
		for _, certificate := range certificates {
			customRoots.AddCert(certificate)
		}
	}
	config.RootCAs = customRoots
	if params.ClientCertPath != "" || params.ClientKeyPath != "" {
		if params.ClientCertPath == "" || params.ClientKeyPath == "" {
			return nil, errors.New("Hive client certificate and key must be configured together")
		}
		certificate, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath)
		if err != nil {
			return nil, fmt.Errorf("load Hive client certificate: %w", err)
		}
		config.Certificates = []tls.Certificate{certificate}
	}
	keyStoreLocation := parameter(values, "sslkeystore")
	if keyStoreLocation != "" {
		if parameter(values, "keystorepassword") == "" && credentialProviderPath != "" {
			return nil, errors.New("Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent")
		}
		certificate, err := loadClientKeyStore(
			keyStoreLocation,
			parameter(values, "keystorepassword"),
			parameter(values, "keystoretype"),
		)
		if err != nil {

View on GitHub (pinned to c0390bff16)

Solutions

Provide both ClientCertPath and ClientKeyPath.
Verify secret mounts include both cert.pem and key.pem.
Combine cert+key into a single PEM and use a config form that accepts a combined file if supported.

Example fix

// before
params.ClientCertPath = "/etc/certs/client.pem"
// after
params.ClientCertPath = "/etc/certs/client.pem"
params.ClientKeyPath = "/etc/certs/client.key"

Defensive patterns

Strategy: validation

Validate before calling

if (params.ClientCertPath == "") != (params.ClientKeyPath == "") {
	return fmt.Errorf("client TLS requires both certificate and key")
}

Prevention

Always configure cert+key as a pair from the same secret/mount
Check secret mounts contain both files at startup
Use a config struct with a Validate() that enforces the pairing

When it happens

Trigger: Setting params.ClientCertPath without params.ClientKeyPath (or vice versa) before opening a connection with client-certificate TLS configured.

Common situations: Mounting only the cert in a container while the key is in a separate secret; typo in the key path variable; assuming the driver can fetch the key from a keystore or OS store when only cert path given.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/81766a9ca3a6377b. Report an issue: GitHub.