When running newt via Docker Compose with mTLS configured through environment variables, I get the following error:
TLS configuration error: cannot use both PKCS12 format (--tls-client-cert) and separate certificate files (--tls-client-cert-file, --tls-client-key, --tls-client-ca)
Expected behavior
I expected newt to use the PEM-separated certificate configuration when setting environment variables, as described in the mTLS documentation.
im still using the Option 1: PKCS12 (Legacy) with PKCS file declared on the env like this
i have just update from 1.4.0 (mtls work) to 1.4.4
Passing only a PKCS#12 certificate should work without triggering errors about PEM files or mixed configurations.
According to the README, there are two mutually exclusive approaches:
PKCS#12 (--tls-client-cert with a .p12 file)
Separate PEM files (--tls-client-cert, --tls-client-key, --tls-ca-cert)
However, when I try to configure the PKCS12 approach via environment variables, it looks like newt still interprets this as PKCS12 + PEM mixed usage, which causes the fatal error.
No PEM environment variables (TLS_CLIENT_KEY, TLS_CA_CERT) are set.
No CLI flags for separate PEM files are used.
The README suggests that using only a PKCS#12 file should be valid.
Questions
Is this behavior expected, or is it a bug?
Is the environment variable mapping for the PEM approach supported?
Could the environment variable handling for PKCS#12 be clarified in the documentation?
Are there hidden default values or other conditions that trigger the “mixed certificate” error?
Should the correct env vars be TLS_CLIENT_CERT, TLS_CLIENT_KEY, TLS_CA_CERT (as I used), or different ones?
If only PKCS12 is supported via env vars, could the docs clarify this limitation?
Thanks for the great work — just looking to clarify the correct way to configure mTLS with Docker Compose.
Originally created by @AblabiX on GitHub (Sep 8, 2025).
Original GitHub issue: https://github.com/fosrl/newt/issues/133
## Summary
When running `newt` via Docker Compose with mTLS configured through environment variables, I get the following error:
>TLS configuration error: cannot use both PKCS12 format (--tls-client-cert) and separate certificate files (--tls-client-cert-file, --tls-client-key, --tls-client-ca)
## Expected behavior
I expected `newt` to use the PEM-separated certificate configuration when setting environment variables, as described in the [mTLS documentation](https://github.com/fosrl/newt?tab=readme-ov-file#mtls).
im still using the Option 1: PKCS12 (Legacy) with PKCS file declared on the env like this
i have just update from 1.4.0 (mtls work) to 1.4.4
Passing only a PKCS#12 certificate should work without triggering errors about PEM files or mixed configurations.
services:
newt:
image: fosrl/newt:latest
container_name: newt
restart: unless-stopped
environment:
- PANGOLIN_ENDPOINT=REDACTED
- NEWT_ID=REDACTED
- NEWT_SECRET=REDACTED
- TLS_CLIENT_CERT=./client.p12
## Notes
According to the README, there are two mutually exclusive approaches:
PKCS#12 (--tls-client-cert with a .p12 file)
Separate PEM files (--tls-client-cert, --tls-client-key, --tls-ca-cert)
However, when I try to configure the PKCS12 approach via environment variables, it looks like newt still interprets this as PKCS12 + PEM mixed usage, which causes the fatal error.
No PEM environment variables (TLS_CLIENT_KEY, TLS_CA_CERT) are set.
No CLI flags for separate PEM files are used.
The README suggests that using only a PKCS#12 file should be valid.
## Questions
Is this behavior expected, or is it a bug?
Is the environment variable mapping for the PEM approach supported?
Could the environment variable handling for PKCS#12 be clarified in the documentation?
Are there hidden default values or other conditions that trigger the “mixed certificate” error?
Should the correct env vars be TLS_CLIENT_CERT, TLS_CLIENT_KEY, TLS_CA_CERT (as I used), or different ones?
If only PKCS12 is supported via env vars, could the docs clarify this limitation?
___
Thanks for the great work — just looking to clarify the correct way to configure mTLS with Docker Compose.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @AblabiX on GitHub (Sep 8, 2025).
Original GitHub issue: https://github.com/fosrl/newt/issues/133
Summary
When running
newtvia Docker Compose with mTLS configured through environment variables, I get the following error:Expected behavior
I expected
newtto use the PEM-separated certificate configuration when setting environment variables, as described in the mTLS documentation.im still using the Option 1: PKCS12 (Legacy) with PKCS file declared on the env like this
i have just update from 1.4.0 (mtls work) to 1.4.4
Passing only a PKCS#12 certificate should work without triggering errors about PEM files or mixed configurations.
services:
newt:
image: fosrl/newt:latest
container_name: newt
restart: unless-stopped
environment:
- PANGOLIN_ENDPOINT=REDACTED
- NEWT_ID=REDACTED
- NEWT_SECRET=REDACTED
- TLS_CLIENT_CERT=./client.p12
Notes
According to the README, there are two mutually exclusive approaches:
PKCS#12 (--tls-client-cert with a .p12 file)
Separate PEM files (--tls-client-cert, --tls-client-key, --tls-ca-cert)
However, when I try to configure the PKCS12 approach via environment variables, it looks like newt still interprets this as PKCS12 + PEM mixed usage, which causes the fatal error.
No PEM environment variables (TLS_CLIENT_KEY, TLS_CA_CERT) are set.
No CLI flags for separate PEM files are used.
The README suggests that using only a PKCS#12 file should be valid.
Questions
Is this behavior expected, or is it a bug?
Is the environment variable mapping for the PEM approach supported?
Could the environment variable handling for PKCS#12 be clarified in the documentation?
Are there hidden default values or other conditions that trigger the “mixed certificate” error?
Should the correct env vars be TLS_CLIENT_CERT, TLS_CLIENT_KEY, TLS_CA_CERT (as I used), or different ones?
If only PKCS12 is supported via env vars, could the docs clarify this limitation?
Thanks for the great work — just looking to clarify the correct way to configure mTLS with Docker Compose.
@AblabiX commented on GitHub (Sep 20, 2025):
must use TLS_CLIENT_CERT_PKCS12