{"record":{"id":"0cf78aca0b2ed56f","repo":"grafana/k6","slug":"failed-to-read-root-certificate-from-q-w","errorCode":null,"errorMessage":"failed to read root certificate from %q: %w","messagePattern":"failed to read root certificate from %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/output/opentelemetry/tls.go","lineNumber":31,"sourceCode":"func buildTLSConfig(\n\tinsecureSkipVerify null.Bool,\n\tcertPath, clientCertPath, clientKeyPath null.String,\n) (*tls.Config, error) {\n\tset := false\n\ttlsConfig := &tls.Config{\n\t\tMinVersion: tls.VersionTLS13,\n\t}\n\n\tif insecureSkipVerify.Valid {\n\t\ttlsConfig.InsecureSkipVerify = insecureSkipVerify.Bool\n\t\tset = true\n\t}\n\n\t// Load the root certificate\n\tif certPath.Valid {\n\t\tb, err := os.ReadFile(certPath.String) //nolint:forbidigo\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to read root certificate from %q: %w\", certPath.String, err)\n\t\t}\n\n\t\tcp := x509.NewCertPool()\n\t\tif ok := cp.AppendCertsFromPEM(b); !ok {\n\t\t\treturn nil, errors.New(\"failed to append root certificate to the pool\")\n\t\t}\n\n\t\ttlsConfig.RootCAs = cp\n\t\tset = true\n\t}\n\n\t// Load the client certificate\n\tif clientCertPath.Valid {\n\t\tcert, err := tls.LoadX509KeyPair(clientCertPath.String, clientKeyPath.String)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to load client certificate: %w\", err)\n\t\t}\n","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/grafana/k6/blob/01ffac6f245854c1b8adc6a69857c76a15f90022/internal/output/opentelemetry/tls.go#L13-L49","documentation":"buildTLSConfig for the OpenTelemetry output reads the root CA file given via its config option with os.ReadFile; this error wraps that read failure (missing file, permissions, path typo). The exporter requires a valid CA bundle to build its tls.Config and refuses to start.","triggerScenarios":"Thrown at internal/output/opentelemetry/tls.go:31 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the certificate file path and read permissions","Use an absolute path for K6_OTEL_TLS_CERT","Remove the setting if no custom CA is needed"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ffac6f245854c1b8adc6a69857c76a15f90022","analyzedAt":"2026-08-18T03:05:52.393Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}