diff --git a/src/libxrpl/telemetry/TelemetryConfig.cpp b/src/libxrpl/telemetry/TelemetryConfig.cpp
index fb3b61067b..da6f340b50 100644
--- a/src/libxrpl/telemetry/TelemetryConfig.cpp
+++ b/src/libxrpl/telemetry/TelemetryConfig.cpp
@@ -7,11 +7,13 @@
     See cfg/xrpld-example.cfg for the full list of available options.
 */
 
+#include <xrpl/basics/contract.h>
 #include <xrpl/config/BasicConfig.h>
 #include <xrpl/telemetry/Telemetry.h>
 
 #include <chrono>
 #include <cstdint>
+#include <stdexcept>
 #include <string>
 
 namespace xrpl::telemetry {
@@ -102,6 +104,16 @@ setupTelemetry(
     setup.tlsClientCertPath = section.valueOr<std::string>(key::tlsClientCert, "");
     setup.tlsClientKeyPath = section.valueOr<std::string>(key::tlsClientKey, "");
 
+    // Mutual TLS needs both the client certificate and its private key.
+    // Supplying only one fails later with a cryptic SSL handshake error, so
+    // reject the partial configuration here with an actionable message.
+    if (setup.tlsClientCertPath.empty() != setup.tlsClientKeyPath.empty())
+    {
+        Throw<std::runtime_error>(
+            "[telemetry] tls_client_cert and tls_client_key must be set together "
+            "(set both for mutual TLS, or neither for one-way TLS).");
+    }
+
     // Head sampling is intentionally fixed at 1.0 (sample everything) and is
     // not read from config. A per-node ratio would let nodes make divergent
     // keep/drop decisions for the same distributed trace, producing broken
diff --git a/src/tests/libxrpl/telemetry/TelemetryConfig.cpp b/src/tests/libxrpl/telemetry/TelemetryConfig.cpp
index c8469bb44b..b9458b66ac 100644
--- a/src/tests/libxrpl/telemetry/TelemetryConfig.cpp
+++ b/src/tests/libxrpl/telemetry/TelemetryConfig.cpp
@@ -4,6 +4,8 @@
 
 #include <gtest/gtest.h>
 
+#include <stdexcept>
+
 using namespace xrpl;
 
 TEST(TelemetryConfig, setup_defaults)
@@ -83,6 +85,43 @@ TEST(TelemetryConfig, parse_full_section)
     EXPECT_FALSE(setup.traceLedger);
 }
 
+TEST(TelemetryConfig, mtls_cert_and_key_both_set)
+{
+    Section section;
+    section.set("use_tls", "1");
+    section.set("tls_client_cert", "/etc/ssl/client.pem");
+    section.set("tls_client_key", "/etc/ssl/client.key");
+
+    auto setup = telemetry::setupTelemetry(section, "nHUtest123", "2.0.0", 0);
+    EXPECT_EQ(setup.tlsClientCertPath, "/etc/ssl/client.pem");
+    EXPECT_EQ(setup.tlsClientKeyPath, "/etc/ssl/client.key");
+}
+
+TEST(TelemetryConfig, mtls_cert_without_key_throws)
+{
+    Section section;
+    section.set("tls_client_cert", "/etc/ssl/client.pem");
+    EXPECT_THROW(telemetry::setupTelemetry(section, "nHUtest123", "2.0.0", 0), std::runtime_error);
+}
+
+TEST(TelemetryConfig, mtls_key_without_cert_throws)
+{
+    Section section;
+    section.set("tls_client_key", "/etc/ssl/client.key");
+    EXPECT_THROW(telemetry::setupTelemetry(section, "nHUtest123", "2.0.0", 0), std::runtime_error);
+}
+
+TEST(TelemetryConfig, mtls_neither_set_is_one_way_tls)
+{
+    Section section;
+    section.set("use_tls", "1");
+    section.set("tls_ca_cert", "/etc/ssl/ca.pem");
+
+    auto setup = telemetry::setupTelemetry(section, "nHUtest123", "2.0.0", 0);
+    EXPECT_TRUE(setup.tlsClientCertPath.empty());
+    EXPECT_TRUE(setup.tlsClientKeyPath.empty());
+}
+
 TEST(TelemetryConfig, null_telemetry_factory)
 {
     telemetry::Telemetry::Setup setup;