VictoriaMetrics/VictoriaMetrics · error

cannot create http client for -snapshot.createURL=%q: %w

Error message

cannot create http client for -snapshot.createURL=%q: %w

What it means

After parsing the -snapshot.createURL, snapshot.Create builds an HTTP client (with TLS/proxy settings). If GetHTTPClient fails — typically a TLS configuration problem such as a missing or unreadable certificate/key file — creation cannot proceed and this error wraps the cause with the target URL for context.

Source

Thrown at lib/snapshot/snapshot.go:43

)

type snapshot struct {
	Status   string `json:"status"`
	Snapshot string `json:"snapshot"`
	Msg      string `json:"msg"`
}

// Create creates a snapshot via the provided api endpoint and returns the snapshot name
func Create(ctx context.Context, createSnapshotURL string) (string, error) {
	logger.Infof("Creating snapshot")
	u, err := url.Parse(createSnapshotURL)
	if err != nil {
		return "", fmt.Errorf("cannot parse -snapshot.createURL: %w", err)
	}

	hc, err := GetHTTPClient()
	if err != nil {
		return "", fmt.Errorf("cannot create http client for -snapshot.createURL=%q: %w", createSnapshotURL, err)
	}
	req, err := http.NewRequestWithContext(ctx, http.MethodPost, createSnapshotURL, nil)
	if err != nil {
		return "", fmt.Errorf("cannot create request for -snapshot.createURL=%q: %w", createSnapshotURL, err)
	}
	resp, err := hc.Do(req)
	if err != nil {
		return "", err
	}
	defer resp.Body.Close()

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		return "", err
	}
	if resp.StatusCode != http.StatusOK {
		return "", fmt.Errorf("unexpected status code returned from %q: %d; expecting %d; response body: %q", u.Redacted(), resp.StatusCode, http.StatusOK, body)
	}

View on GitHub (pinned to 5079fb58f1)

Solutions

1. Verify all TLS flag paths (-tls*, -snapshot.* TLS options) point to existing, readable files inside the running environment.
2. Read the wrapped error (%w cause) to identify which cert/key failed and why.
3. Mount/repair the CA and client certificate files if running in Docker/Kubernetes.
4. If the endpoint is plain HTTP, remove the TLS flags so no client TLS config is attempted.

Example fix

// before
-snapshot.createURL=https://vm:8428/snapshot/create -tlsCAFile=/missing/ca.crt
// after
-snapshot.createURL=https://vm:8428/snapshot/create -tlsCAFile=/etc/vm/ca.crt

for _, f := range []string{tlsCAFile, tlsCertFile, tlsKeyFile} {
	if f != "" {
		if _, err := os.Stat(f); err != nil {
			log.Fatalf("TLS file missing: %s: %v", f, err)
		}
	}
}

When it happens

Trigger: Calling snapshot.Create (or running the tool) where TLS flags like -tlsCAFile/-tlsCertFile/-tlsKeyFile point to nonexistent, unreadable, or malformed files, causing GetHTTPClient to error.

Common situations: Running inside a container where the mounted CA/cert files are missing or have wrong permissions, typos in TLS flag paths, or enabling -tls without providing the CA used by the server.

Related errors

• cannot create client for %q: %w
• cannot build auth client: %w
• cannot create HTTP client for %q: %w
• cannot create HTTP client for %q: %w
• cannot create HTTP client for %q: %w

AI-assisted analysis of VictoriaMetrics/VictoriaMetrics@5079fb58f1 (2026-09-03). Data as JSON: /api/errors/dfb60ba964658825. Report an issue: GitHub.