{"id":"f9bbfd4c08da1f98","repo":"psf/requests","slug":"could-not-find-the-tls-certificate-file-invalid-p","errorCode":null,"errorMessage":"Could not find the TLS certificate file, invalid path: {conn.cert_file}","messagePattern":"Could not find the TLS certificate file, invalid path: (.+?)","errorType":"exception","errorClass":"OSError","httpStatus":null,"severity":"error","filePath":"src/requests/adapters.py","lineNumber":356,"sourceCode":"\n            if not os.path.isdir(cert_loc):\n                conn.ca_certs = cert_loc\n            else:\n                conn.ca_cert_dir = cert_loc\n        else:\n            conn.cert_reqs = \"CERT_NONE\"\n            conn.ca_certs = None\n            conn.ca_cert_dir = None\n\n        if cert:\n            if not isinstance(cert, basestring):\n                conn.cert_file = cert[0]\n                conn.key_file = cert[1]\n            else:\n                conn.cert_file = cert\n                conn.key_file = None\n            if conn.cert_file and not os.path.exists(conn.cert_file):\n                raise OSError(\n                    f\"Could not find the TLS certificate file, \"\n                    f\"invalid path: {conn.cert_file}\"\n                )\n            if conn.key_file and not os.path.exists(conn.key_file):\n                raise OSError(\n                    f\"Could not find the TLS key file, invalid path: {conn.key_file}\"\n                )\n\n    def build_response(self, req: PreparedRequest, resp: Any) -> Response:\n        \"\"\"Builds a :class:`Response <requests.Response>` object from a urllib3\n        response. This should not be called from user code, and is only exposed\n        for use when subclassing the\n        :class:`HTTPAdapter <requests.adapters.HTTPAdapter>`\n\n        :param req: The :class:`PreparedRequest <PreparedRequest>` used to generate the response.\n        :param resp: The urllib3 response object.\n        :rtype: requests.Response\n        \"\"\"","sourceCodeStart":338,"sourceCodeEnd":374,"githubUrl":"https://github.com/psf/requests/blob/414f0513c33883adf6f2b46901d4f0b38a455851/src/requests/adapters.py#L338-L374","documentation":"Raised in HTTPAdapter.cert_verify when a client certificate was supplied via the `cert` parameter but the certificate file path does not exist on disk. requests sets conn.cert_file from either the string form (cert='path.pem') or the first element of the tuple form (cert=('cert.pem','key.pem')) and validates existence before handing the connection to urllib3, failing fast instead of producing an opaque SSL handshake error.","triggerScenarios":"requests.get(url, cert='client.pem') or cert=('client.crt','client.key') where the cert path is wrong or relative to a different working directory; Session.cert set to a stale path. Checked at src/requests/adapters.py:355-359 whenever cert is truthy.","commonSituations":"Relative cert paths that break when the script runs from a different cwd (cron, systemd, containers); certs mounted into containers at a different path than configured; rotated/expired mTLS certs deleted during renewal; config files referencing another developer's home directory.","solutions":["Verify the path exists (os.path.exists) and use an absolute path for the client certificate","Fix the cert tuple order — it must be (cert_file, key_file), not (key, cert)","In containers/cron, confirm the cert is mounted/deployed at the configured path","If the key is embedded in the same PEM as the cert, pass a single string path instead of a tuple"],"exampleFix":"# before\nrequests.get(url, cert=('client.crt', 'client.key'))  # relative, cwd-dependent\n\n# after\nfrom pathlib import Path\ncert_dir = Path(__file__).parent / 'certs'\nrequests.get(url, cert=(str(cert_dir/'client.crt'), str(cert_dir/'client.key')))","handlingStrategy":"validation","validationCode":"import os\ncert_file = cert[0] if isinstance(cert, tuple) else cert\nif not os.path.isfile(cert_file):\n    raise FileNotFoundError(f\"Client TLS certificate not found: {cert_file}\")","typeGuard":null,"tryCatchPattern":"try:\n    resp = session.get(url, cert=(cert_file, key_file))\nexcept OSError as e:\n    raise RuntimeError(f\"Client cert path invalid: {cert_file}\") from e","preventionTips":["Check os.path.isfile on the client cert before constructing the session","Load cert paths from validated config, converting to absolute paths at load time","Verify file permissions allow the process to read the cert, not just that it exists"],"tags":["tls","client-certificates","mtls","configuration","python"],"analyzedSha":"414f0513c33883adf6f2b46901d4f0b38a455851","analyzedAt":"2026-07-31T19:24:57.696Z","schemaVersion":2}