{"record":{"id":"0f4786199209cb21","repo":"temporalio/temporal","slug":"loading-server-tls-certificate-failed-v","errorCode":null,"errorMessage":"loading server tls certificate failed: %v","messagePattern":"loading server tls certificate failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"common/rpc/encryption/local_store_tls_provider.go","lineNumber":333,"sourceCode":"\t\t\treturn getServerTLSConfigFromCertProvider(certProvider, clientAuthRequired, remoteAddress, c.ServerName, logger)\n\t\t}\n\t\treturn getServerTLSConfigFromCertProvider(certProvider, clientAuthRequired, remoteAddress, c.ServerName, logger)\n\t}\n\n\treturn tlsConfig, nil\n}\n\nfunc getServerTLSConfigFromCertProvider(\n\tcertProvider CertProvider,\n\trequireClientAuth bool,\n\tremoteAddress string,\n\tserverName string,\n\tlogger log.Logger) (*tls.Config, error) {\n\n\t// Get serverCert from disk\n\tserverCert, err := certProvider.FetchServerCertificate()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"loading server tls certificate failed: %v\", err)\n\t}\n\n\t// tls disabled, responsibility of cert provider above to error otherwise\n\tif serverCert == nil {\n\t\treturn nil, nil\n\t}\n\n\t// Default to NoClientAuth\n\tclientAuthType := tls.NoClientCert\n\tvar clientCaPool *x509.CertPool\n\n\t// If mTLS enabled\n\tif requireClientAuth {\n\t\tclientAuthType = tls.RequireAndVerifyClientCert\n\n\t\tca, err := certProvider.FetchClientCAs()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to fetch client CAs: %v\", err)","sourceCodeStart":315,"sourceCodeEnd":351,"githubUrl":"https://github.com/temporalio/temporal/blob/bde624efd13fbd3843654058db6d9c716166318b/common/rpc/encryption/local_store_tls_provider.go#L315-L351","documentation":"getServerTLSConfigFromCertProvider fetches the server certificate from the configured cert provider and wraps any FetchServerCertificate failure as \"loading server tls certificate failed: %v\". It is raised during TLS config construction for the server (newServerTLSConfig or a callback) when the local-store cert provider cannot supply a server cert. The underlying provider error is formatted with %v, so the chain is not preserved.","triggerScenarios":"Server startup (newServerTLSConfig) or a refresh callback where certProvider.FetchServerCertificate() returns an error — e.g. cert file missing/unreadable, PEM decode failure (error 390), or x509 parse failure.","commonSituations":"Temporal server starting with a bad localStore TLS config: wrong CertFilePath/KeyFilePath, secrets not mounted, file permission denied, malformed certificate, or the cert provider's watch path pointing to a nonexistent directory.","solutions":["Inspect the wrapped %v text for the root cause (file not found, PEM decode, x509 parse) and fix the underlying provider input.","Verify serverTLS.certFilePath and keyFilePath point to existing, readable PEM files.","Check file permissions and that the secret/volume mount is present before service start.","Validate the cert/key pair matches (openssl x509 -noout -modulus vs openssl rsa -noout -modulus)."],"exampleFix":"// before\nserverTLS:\n  certFilePath: /etc/certs/server.crt   # file does not exist\n// after\nserverTLS:\n  certFilePath: /etc/temporal/tls/server.pem\n  keyFilePath: /etc/temporal/tls/server-key.pem","handlingStrategy":"validation","validationCode":"cert, err := os.ReadFile(cfg.CertFilePath)\nif err != nil { return fmt.Errorf(\"server cert unreadable: %w\", err) }\nkey, err := os.ReadFile(cfg.KeyFilePath)\nif err != nil { return fmt.Errorf(\"server key unreadable: %w\", err) }\nif _, err := tls.X509KeyPair(cert, key); err != nil { return fmt.Errorf(\"bad server cert/key pair: %w\", err) }","typeGuard":null,"tryCatchPattern":"cfg, err := getServerTLSConfigFromCertProvider(...)\nif err != nil && strings.Contains(err.Error(), \"loading server tls certificate failed\") {\n    logger.Fatal(\"cannot start: server TLS cert invalid\", \"cause\", err)\n}","preventionTips":["Validate cert/key paths and permissions in deployment manifests before rollout.","Use readiness probes that fail when TLS material is missing.","Rotate secrets with atomic volume updates and re-verify after each rotation."],"tags":["tls","server","certificate","startup"],"backgroundTag":"tls-server-cert-load-failed","analyzedSha":"bde624efd13fbd3843654058db6d9c716166318b","analyzedAt":"2026-09-01T07:18:39.080Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}