t8y2/dbx · error

load Hive client certificate

Error message

load Hive client certificate: %w

What it means

This error wraps tls.LoadX509KeyPair failures when loading the client certificate and private key for mutual TLS with HiveServer2 (config.go:1092). It fires when clientcert/clientkey paths are both configured but the pair cannot be loaded — unreadable files, bad PEM encoding, or a key that does not match the certificate.

Solutions

1. Verify both the client cert and key files exist and are readable by the process.
2. Confirm the certificate and key are a matching pair (compare modulus/public key).
3. Ensure the key PEM is unencrypted or re-export it without a passphrase.
4. Regenerate or re-download the client certificate pair if the PEM is malformed.

Example fix

// before
config.Certificates, err = tls.LoadX509KeyPair("client.crt", "old-client.key")
// after
config.Certificates, err = tls.LoadX509KeyPair("/etc/hive/client.crt", "/etc/hive/client.key")

if params.ClientCertPath != "" || params.ClientKeyPath != "" {
    if params.ClientCertPath == "" || params.ClientKeyPath == "" {
        return errors.New("client cert and key must both be set")
    }
    for _, p := range []string{params.ClientCertPath, params.ClientKeyPath} {
        if _, err := os.Stat(p); err != nil {
            return fmt.Errorf("mTLS file not accessible: %s", p)
        }
    }
}

When it happens

Trigger: Both params.ClientCertPath and params.ClientKeyPath are set, and tls.LoadX509KeyPair(certPath, keyPath) fails: file missing/unreadable, invalid PEM, encrypted key without decryption support, or cert/key mismatch.

Common situations: mTLS setup where the client cert and key were rotated out of sync; key file has a passphrase the driver cannot prompt for; copying only the cert into a container but not the key; concatenated wrong cert/key pair.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• both client_cert_path and client_key_path are required for…
• Client certificate and key must be provided together
• Client certificate and key must be provided together
• Client certificate and key must be provided together
• failed to parse CA certificate at

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/6cb44264a4ab52f8. Report an issue: GitHub.

Appendix: source

Thrown at agents/drivers/hive-go/config.go:1092

		)
		if err != nil {
			return nil, fmt.Errorf("load Hive truststore: %w", err)
		}
		if customRoots == nil {
			customRoots = x509.NewCertPool()
		}
		for _, certificate := range certificates {
			customRoots.AddCert(certificate)
		}
	}
	config.RootCAs = customRoots
	if params.ClientCertPath != "" || params.ClientKeyPath != "" {
		if params.ClientCertPath == "" || params.ClientKeyPath == "" {
			return nil, errors.New("Hive client certificate and key must be configured together")
		}
		certificate, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath)
		if err != nil {
			return nil, fmt.Errorf("load Hive client certificate: %w", err)
		}
		config.Certificates = []tls.Certificate{certificate}
	}
	keyStoreLocation := parameter(values, "sslkeystore")
	if keyStoreLocation != "" {
		if parameter(values, "keystorepassword") == "" && credentialProviderPath != "" {
			return nil, errors.New("Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent")
		}
		certificate, err := loadClientKeyStore(
			keyStoreLocation,
			parameter(values, "keystorepassword"),
			parameter(values, "keystoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load Hive keystore: %w", err)
		}
		config.Certificates = append(config.Certificates, certificate)
	}

View on GitHub (pinned to c0390bff16)