thanos-io/thanos · error

unable to use specified client cert

Error message

unable to use specified client cert (%s) & key (%s): %s

What it means

getClientCertificate fails because tls.LoadX509KeyPair cannot load the configured client cert/key pair — files missing, unreadable, malformed, or not matching as a pair. NewTLSConfig surfaces it during config construction.

Solutions

1. Verify both cert and key files exist, are readable, and are valid PEM.
2. Ensure cert and key match as a pair.
3. Reissue the certificate if expired or mismatched.

When it happens

Trigger: Thrown at pkg/exthttp/tlsconfig.go:84 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of thanos-io/thanos@35b8b99117 (2026-09-07). Data as JSON: /api/errors/fa7bb06495319d3d. Report an issue: GitHub.

Appendix: source

Thrown at pkg/exthttp/tlsconfig.go:84

	}
	return data, nil
}

// updateRootCA parses the given byte slice as a series of PEM encoded certificates and updates tls.Config.RootCAs.
func updateRootCA(cfg *tls.Config, b []byte) bool {
	caCertPool := x509.NewCertPool()
	if !caCertPool.AppendCertsFromPEM(b) {
		return false
	}
	cfg.RootCAs = caCertPool
	return true
}

// getClientCertificate reads the pair of client cert and key from disk and returns a tls.Certificate.
func (c *TLSConfig) getClientCertificate(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
	cert, err := tls.LoadX509KeyPair(c.CertFile, c.KeyFile)
	if err != nil {
		return nil, fmt.Errorf("unable to use specified client cert (%s) & key (%s): %s", c.CertFile, c.KeyFile, err)
	}
	return &cert, nil
}

View on GitHub (pinned to 35b8b99117)