VictoriaMetrics/VictoriaMetrics · error

cannot parse TLS config for OAuth2: %w

Error message

cannot parse TLS config for OAuth2: %w

What it means

newOAuth2ConfigInternal builds an auth Config from the OAuth2Config's embedded TLS settings by creating Options and calling NewConfig. This error wraps any failure of that TLS config parsing/validation, so the OAuth2 client cannot be initialized with the requested TLS parameters.

Source

Thrown at lib/promauth/config.go:216

			ClientID:       o.ClientID,
			ClientSecret:   o.ClientSecret.String(),
			TokenURL:       o.TokenURL,
			Scopes:         o.Scopes,
			EndpointParams: urlValuesFromMap(o.EndpointParams),
		},
	}
	if o.ClientSecretFile != "" {
		oi.clientSecretFile = fscore.GetFilepath(baseDir, o.ClientSecretFile)
		// There is no need in reading oi.clientSecretFile now, since it may be missing right now.
		// It is read later before performing oauth2 request to server.
	}
	opts := &Options{
		BaseDir:   baseDir,
		TLSConfig: o.TLSConfig,
	}
	ac, err := opts.NewConfig()
	if err != nil {
		return nil, fmt.Errorf("cannot parse TLS config for OAuth2: %w", err)
	}
	oi.ac = ac
	if o.ProxyURL != "" {
		u, err := url.Parse(o.ProxyURL)
		if err != nil {
			return nil, fmt.Errorf("cannot parse proxy_url=%q: %w", o.ProxyURL, err)
		}
		oi.proxyURL = o.ProxyURL
		oi.proxyURLFunc = http.ProxyURL(u)
	}
	tokenURLHeaders, err := parseHeaders(o.Headers)
	if err != nil {
		return nil, fmt.Errorf("cannot parse headers for token_url: %w", err)
	}
	oi.tokenURLHeaders = tokenURLHeaders
	return oi, nil
}

View on GitHub (pinned to 5079fb58f1)

Solutions

1. Verify all TLS file paths (ca, cert, key) in the oauth2 block exist and are readable by the process
2. Validate the PEM content (openssl x509 -in ca.crt -text) to ensure files are valid certificates/keys
3. Check container/volume mounts are present before the app starts
4. Inspect the wrapped %w error from NewConfig to pinpoint which option failed

Example fix

// before
oauth2:
  tls_ca: /etc/certs/ca.pem   # file missing
// after: mount or fix the path
oauth2:
  tls_ca: /etc/ssl/certs/ca.pem

for _, p := range []string{oauthCfg.TLSConfig.CA, oauthCfg.TLSConfig.Cert, oauthCfg.TLSConfig.Key} {
    if p != "" {
        if _, err := os.ReadFile(p); err != nil {
            return fmt.Errorf("TLS file %q unreadable before OAuth2 init: %w", p, err)
        }
    }
}

func tlsFilesReadable(c promauth.TLSConfig) bool {
    for _, p := range []string{c.CA, c.Cert, c.Key} {
        if p != "" {
            if _, err := os.ReadFile(p); err != nil {
                return false
            }
        }
    }
    return true
}

if err := ac.InitFromOAuth2Config(oauthCfg); err != nil {
    if strings.Contains(err.Error(), "cannot parse TLS config for OAuth2") {
        return fmt.Errorf("check TLS cert/key/CA paths and PEM validity for oauth2: %w", err)
    }
    return err
}

When it happens

Trigger: initFromOAuth2Config -> newOAuth2ConfigInternal where opts.NewConfig() fails — e.g. tls_ca/tls_cert/tls_key files referenced by the embedded TLSConfig cannot be read or parsed, or TLS options are invalid.

Common situations: CA/cert/key file paths wrong or files missing inside the container; PEM files with invalid content (wrong format, expired cert not yet relevant at parse time); mount not present at startup; permissions deny reading the cert files.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• cannot load TLS certificate and key files: %w
• cannot use TLS min version from tlsMinVersion=%q. Supported
• cannot use TLS cipher suites from tlsCipherSuites=%q: %w
• unsupported TLS cipher suite name: %s
• unsupported TLS version %q

AI-assisted analysis of VictoriaMetrics/VictoriaMetrics@5079fb58f1 (2026-09-03). Data as JSON: /api/errors/5d32d127e3b667bf. Report an issue: GitHub.