t8y2/dbx · error

load Hive client certificate: %w

Error message

load Hive client certificate: %w

What it means

This error wraps tls.LoadX509KeyPair failures when loading the client certificate and private key for mutual TLS with HiveServer2 (config.go:1092). It fires when clientcert/clientkey paths are both configured but the pair cannot be loaded — unreadable files, bad PEM encoding, or a key that does not match the certificate.

Source

Thrown at agents/drivers/hive-go/config.go:1092

		)
		if err != nil {
			return nil, fmt.Errorf("load Hive truststore: %w", err)
		}
		if customRoots == nil {
			customRoots = x509.NewCertPool()
		}
		for _, certificate := range certificates {
			customRoots.AddCert(certificate)
		}
	}
	config.RootCAs = customRoots
	if params.ClientCertPath != "" || params.ClientKeyPath != "" {
		if params.ClientCertPath == "" || params.ClientKeyPath == "" {
			return nil, errors.New("Hive client certificate and key must be configured together")
		}
		certificate, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath)
		if err != nil {
			return nil, fmt.Errorf("load Hive client certificate: %w", err)
		}
		config.Certificates = []tls.Certificate{certificate}
	}
	keyStoreLocation := parameter(values, "sslkeystore")
	if keyStoreLocation != "" {
		if parameter(values, "keystorepassword") == "" && credentialProviderPath != "" {
			return nil, errors.New("Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent")
		}
		certificate, err := loadClientKeyStore(
			keyStoreLocation,
			parameter(values, "keystorepassword"),
			parameter(values, "keystoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load Hive keystore: %w", err)
		}
		config.Certificates = append(config.Certificates, certificate)
	}

View on GitHub (pinned to c0390bff16)

Solutions

1. Verify both the client cert and key files exist and are readable by the process.
2. Confirm the certificate and key are a matching pair (compare modulus/public key).
3. Ensure the key PEM is unencrypted or re-export it without a passphrase.
4. Regenerate or re-download the client certificate pair if the PEM is malformed.

Example fix

// before
config.Certificates, err = tls.LoadX509KeyPair("client.crt", "old-client.key")
// after
config.Certificates, err = tls.LoadX509KeyPair("/etc/hive/client.crt", "/etc/hive/client.key")

if params.ClientCertPath != "" || params.ClientKeyPath != "" {
    if params.ClientCertPath == "" || params.ClientKeyPath == "" {
        return errors.New("client cert and key must both be set")
    }
    for _, p := range []string{params.ClientCertPath, params.ClientKeyPath} {
        if _, err := os.Stat(p); err != nil {
            return fmt.Errorf("mTLS file not accessible: %s", p)
        }
    }
}

When it happens

Trigger: Both params.ClientCertPath and params.ClientKeyPath are set, and tls.LoadX509KeyPair(certPath, keyPath) fails: file missing/unreadable, invalid PEM, encrypted key without decryption support, or cert/key mismatch.

Common situations: mTLS setup where the client cert and key were rotated out of sync; key file has a passphrase the driver cannot prompt for; copying only the cert into a container but not the key; concatenated wrong cert/key pair.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Client certificate and key must be provided together
• Hive client certificate and key must be configured together
• JKS private key entry has no certificate chain
• JKS keystore contains no private key entry
• Client certificate and key must be provided together

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/6cb44264a4ab52f8. Report an issue: GitHub.