VictoriaMetrics/VictoriaMetrics · error

cannot parse data read from `ca_file` %q

Error message

cannot parse data read from `ca_file` %q

What it means

Returned by the getTLSRootCA closure when `ca_file` was read successfully but its contents contain no parseable PEM certificates (AppendCertsFromPEM returned false). Distinguishes 'file unreadable' (521) from 'file readable but not a valid CA cert'.

Source

Thrown at lib/promauth/config.go:985

		rootCA := x509.NewCertPool()
		if !rootCA.AppendCertsFromPEM([]byte(tc.CA)) {
			return fmt.Errorf("cannot parse data from `ca` value")
		}
		tctx.getTLSRootCA = func() (*x509.CertPool, error) {
			return rootCA, nil
		}
		h := xxhash.Sum64([]byte(tc.CA))
		tctx.tlsRootCADigest = fmt.Sprintf("digest(CA)=%d", h)
	} else if tc.CAFile != "" {
		path := fscore.GetFilepath(baseDir, tc.CAFile)
		tctx.getTLSRootCA = func() (*x509.CertPool, error) {
			data, err := fscore.ReadFileOrHTTP(path)
			if err != nil {
				return nil, fmt.Errorf("cannot read `ca_file`: %w", err)
			}
			rootCA := x509.NewCertPool()
			if !rootCA.AppendCertsFromPEM(data) {
				return nil, fmt.Errorf("cannot parse data read from `ca_file` %q", tc.CAFile)
			}
			return rootCA, nil
		}
		tctx.tlsRootCADigest = fmt.Sprintf("caFile=%q", tc.CAFile)
	}
	v, err := netutil.ParseTLSVersion(tc.MinVersion)
	if err != nil {
		return fmt.Errorf("cannot parse `min_version`: %w", err)
	}
	tctx.minVersion = v
	return nil
}

View on GitHub (pinned to 5079fb58f1)

Solutions

1. Run `openssl x509 -in <ca_file> -noout` to verify it is a valid PEM certificate; re-export in PEM format if it fails
2. Convert DER/PFX to PEM: `openssl x509 -inform der -in cert.der -out ca.pem` or `openssl pkcs12 -in bundle.pfx -nokeys -out ca.pem`
3. Ensure the file holds the CA certificate, not the private key or CSR (look for '-----BEGIN CERTIFICATE-----')
4. Re-download or re-copy the file if it is empty/truncated

Example fix

# before
openssl pkcs12 -in ca.pfx -nodes -out ca.pem   # key+cert, may fail pool
# after
openssl pkcs12 -in ca.pfx -nokeys -cacerts -out ca.pem

data, err := os.ReadFile(cfg.TLS.CAFile)
if err != nil {
	return err
}
if !x509.NewCertPool().AppendCertsFromPEM(data) {
	return fmt.Errorf("ca_file %q does not contain a valid PEM certificate", cfg.TLS.CAFile)
}

When it happens

Trigger: ca_file contains an empty file, a private key instead of a certificate, a DER/ binary cert, a PKCS#12 bundle, base64-encoded PEM, or only intermediate/leaf certs not recognized as parseable PEM.

Common situations: Pointing ca_file at the client key or cert chain position swapped; exporting a Windows/PFX cert without converting (`openssl x509 -in cert.crt -inform der -out ca.pem`); writing a CSR or public key instead of the CA cert; a truncated download.

Related errors

• cannot parse data from `ca` value
• failed to parse key %q: %w
• cannot read `ca_file`: %w
• failed to parse key %q: failed to decode PEM block containin
• cannot load TLS certificate and key files: %w

AI-assisted analysis of VictoriaMetrics/VictoriaMetrics@5079fb58f1 (2026-09-03). Data as JSON: /api/errors/8eb487c194ae7e0a. Report an issue: GitHub.