{"record":{"id":"0b2016d599206ae1","repo":"docker/cli","slug":"unable-to-get-system-cert-pool-w","errorCode":null,"errorMessage":"unable to get system cert pool: %w","messagePattern":"unable to get system cert pool: %w","errorType":"exception","errorClass":"invalidParameterErr","httpStatus":null,"severity":"error","filePath":"cmd/docker-trust/internal/registry/registry.go","lineNumber":53,"sourceCode":"func loadTLSConfig(ctx context.Context, directory string, tlsConfig *tls.Config) error {\n\tfs, err := os.ReadDir(directory)\n\tif err != nil {\n\t\tif os.IsNotExist(err) {\n\t\t\treturn nil\n\t\t}\n\t\treturn invalidParam(err)\n\t}\n\n\tfor _, f := range fs {\n\t\tif ctx.Err() != nil {\n\t\t\treturn ctx.Err()\n\t\t}\n\t\tswitch filepath.Ext(f.Name()) {\n\t\tcase \".crt\":\n\t\t\tif tlsConfig.RootCAs == nil {\n\t\t\t\tsystemPool, err := x509.SystemCertPool()\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn invalidParam(fmt.Errorf(\"unable to get system cert pool: %w\", err))\n\t\t\t\t}\n\t\t\t\ttlsConfig.RootCAs = systemPool\n\t\t\t}\n\t\t\tfileName := filepath.Join(directory, f.Name())\n\t\t\tlogrus.Debugf(\"crt: %s\", fileName)\n\t\t\tdata, err := os.ReadFile(fileName)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\ttlsConfig.RootCAs.AppendCertsFromPEM(data)\n\t\tcase \".cert\":\n\t\t\tcertName := f.Name()\n\t\t\tkeyName := certName[:len(certName)-5] + \".key\"\n\t\t\tlogrus.Debugf(\"cert: %s\", filepath.Join(directory, certName))\n\t\t\tif !hasFile(fs, keyName) {\n\t\t\t\treturn invalidParamf(\"missing key %s for client certificate %s. CA certificates must use the extension .crt\", keyName, certName)\n\t\t\t}\n\t\t\tcert, err := tls.LoadX509KeyPair(filepath.Join(directory, certName), filepath.Join(directory, keyName))","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cmd/docker-trust/internal/registry/registry.go#L35-L71","documentation":"Returned by loadTLSConfig in docker-trust's registry package (registry.go:53) when x509.SystemCertPool() fails while initializing RootCAs for a .crt certificate being loaded. On Linux SystemCertPool reads the system bundle; failure usually means the bundle path is unreadable or the OS provides none. The error is wrapped via invalidParam.","triggerScenarios":"registry.ReadCertsDirectory encounters a *.crt file, RootCAs is nil, and x509.SystemCertPool() returns an error — e.g. on a minimal/container environment without /etc/ssl/certs/ca-certificates.crt, or where that file exists but cannot be parsed.","commonSituations":"Running docker-trust inside a stripped-down container or scratch image with no CA bundle, an Alpine image without ca-certificates installed, a read-only filesystem blocking the bundle, or a corrupted CA bundle.","solutions":["Install the system CA bundle: `apt-get install ca-certificates` / `apk add ca-certificates`.","Ensure the bundle at /etc/ssl/certs/ca-certificates.crt (or SSL_CERT_FILE) is readable and valid PEM.","Pre-populate tlsConfig.RootCAs yourself before calling ReadCertsDirectory so the SystemCertPool path is skipped.","Set SSL_CERT_FILE/SSL_CERT_DIR to a known-good bundle."],"exampleFix":"// before\ntlsConfig := &tls.Config{}\nif err := registry.ReadCertsDirectory(tlsConfig, certDir); err != nil { ... }\n\n// after: seed RootCAs so SystemCertPool() is never called\npool := x509.NewCertPool()\nif b, err := os.ReadFile(\"/etc/ssl/certs/ca-certificates.crt\"); err == nil {\n    pool.AppendCertsFromPEM(b)\n}\ntlsConfig.RootCAs = pool\nerr := registry.ReadCertsDirectory(tlsConfig, certDir)","handlingStrategy":"validation","validationCode":"// Seed RootCAs so SystemCertPool() is never called by ReadCertsDirectory\npool := x509.NewCertPool()\nif b, err := os.ReadFile(os.Getenv(\"SSL_CERT_FILE\")); err == nil {\n    pool.AppendCertsFromPEM(b)\n} else if b, err := os.ReadFile(\"/etc/ssl/certs/ca-certificates.crt\"); err == nil {\n    pool.AppendCertsFromPEM(b)\n}\ntlsConfig.RootCAs = pool","typeGuard":null,"tryCatchPattern":"// Fallback: if SystemCertPool fails, build a fresh pool\nif _, err := x509.SystemCertPool(); err != nil {\n    tlsConfig.RootCAs = x509.NewCertPool()\n}","preventionTips":["Install ca-certificates in minimal images.","Set SSL_CERT_FILE/SSL_CERT_DIR to a known-good bundle.","Pre-populate tlsConfig.RootCAs before loading cert dirs."],"tags":["tls","certificates","security","environment"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}