t8y2/dbx · error

load Hive client certificate: %w

Error message

load Hive client certificate: %w

What it means

The driver loads a mutual-TLS client identity with tls.LoadX509KeyPair when clientCertPath/clientKeyPath are set, wrapping any failure with this message. LoadX509KeyPair fails on unreadable files, malformed PEM, or cert/key mismatch. It is thrown because mTLS cannot proceed without a usable certificate/key pair.

Source

Thrown at agents/drivers/argo-go/config.go:1089

		)
		if err != nil {
			return nil, fmt.Errorf("load Hive truststore: %w", err)
		}
		if customRoots == nil {
			customRoots = x509.NewCertPool()
		}
		for _, certificate := range certificates {
			customRoots.AddCert(certificate)
		}
	}
	config.RootCAs = customRoots
	if params.ClientCertPath != "" || params.ClientKeyPath != "" {
		if params.ClientCertPath == "" || params.ClientKeyPath == "" {
			return nil, errors.New("Hive client certificate and key must be configured together")
		}
		certificate, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath)
		if err != nil {
			return nil, fmt.Errorf("load Hive client certificate: %w", err)
		}
		config.Certificates = []tls.Certificate{certificate}
	}
	keyStoreLocation := parameter(values, "sslkeystore")
	if keyStoreLocation != "" {
		if parameter(values, "keystorepassword") == "" && credentialProviderPath != "" {
			return nil, errors.New("Hive storePasswordPath uses the Java Hadoop credential-provider format; configure keyStorePassword explicitly for the native agent")
		}
		certificate, err := loadClientKeyStore(
			keyStoreLocation,
			parameter(values, "keystorepassword"),
			parameter(values, "keystoretype"),
		)
		if err != nil {
			return nil, fmt.Errorf("load Hive keystore: %w", err)
		}
		config.Certificates = append(config.Certificates, certificate)
	}

View on GitHub (pinned to c0390bff16)

Solutions

1. Check the wrapped cause: verify both cert and key files exist and are readable
2. Confirm the certificate and key are a matching pair (compare modulus/public key)
3. Ensure both files are PEM-encoded; convert DER to PEM if needed
4. Swap cert/key paths if accidentally reversed in the config

Example fix

// before
openssl x509 -in cert.pem -noout -modulus | md5sum; md5sum key.pem  # mismatch
// after
openssl rsa -in key.pem -out key.pem  # re-export matching key, redeploy both files

if (params.ClientCertPath == "") != (params.ClientKeyPath == "") {
    return errors.New("client cert and key must both be set")
}
if params.ClientCertPath != "" {
    if _, err := tls.LoadX509KeyPair(params.ClientCertPath, params.ClientKeyPath); err != nil {
        return fmt.Errorf("invalid client cert/key pair: %w", err)
    }
}

if err := db.PingContext(ctx); err != nil {
    if strings.HasPrefix(err.Error(), "load Hive client certificate:") {
        log.Fatalf("mTLS identity invalid, check cert/key pair: %v", err)
    }
    return err
}

When it happens

Trigger: Opening a Hive connection with a client certificate and/or key path configured where tls.LoadX509KeyPair fails: missing file, invalid PEM, encrypted key with wrong/missing password, or certificate and key that don't match (or only one of the two paths set — that raises the 'configured together' error instead).

Common situations: Cert renewed but key not updated (or vice versa) causing mismatch; PEM encoding wrong (DER certificate supplied); key file permissions too restrictive for the service account; cert/key paths swapped in config.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Hive client certificate and key must be configured together
• Hive CA certificate contains no certificates
• read Hive CA certificate: %w
• load Hive truststore: %w
• load Hive keystore: %w

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/88dc781627466e52. Report an issue: GitHub.