{"record":{"id":"102626390e431083","repo":"BookStackApp/BookStack","slug":"provided-path-cacertpath-for-ldap-tls-ca-cert","errorCode":null,"errorMessage":"Provided path [{$caCertPath}] for LDAP TLS CA certs could not be resolved to an existing location","messagePattern":"Provided path \\[(.+?)\\] for LDAP TLS CA certs could not be resolved to an existing location","errorType":"exception","errorClass":"LdapException","httpStatus":null,"severity":"error","filePath":"app/Access/LdapService.php","lineNumber":289,"sourceCode":"        return $this->ldapConnection;\n    }\n\n    /**\n     * Configure TLS CA certs globally for ldap use.\n     * This will detect if the given path is a directory or file, and set the relevant\n     * LDAP TLS options appropriately otherwise throw an exception if no file/folder found.\n     *\n     * Note: When using a folder, certificates are expected to be correctly named by hash\n     * which can be done via the c_rehash utility.\n     *\n     * @throws LdapException\n     */\n    protected function configureTlsCaCerts(string $caCertPath): void\n    {\n        $errMessage = \"Provided path [{$caCertPath}] for LDAP TLS CA certs could not be resolved to an existing location\";\n        $path = realpath($caCertPath);\n        if ($path === false) {\n            throw new LdapException($errMessage);\n        }\n\n        if (is_dir($path)) {\n            $this->ldap->setOption(null, LDAP_OPT_X_TLS_CACERTDIR, $path);\n        } else if (is_file($path)) {\n            $this->ldap->setOption(null, LDAP_OPT_X_TLS_CACERTFILE, $path);\n        } else {\n            throw new LdapException($errMessage);\n        }\n    }\n\n    /**\n     * Parse an LDAP server string and return the host suitable for a connection.\n     * Is flexible to formats such as 'ldap.example.com:8069' or 'ldaps://ldap.example.com'.\n     */\n    protected function parseServerString(string $serverString): string\n    {\n        if (str_starts_with($serverString, 'ldaps://') || str_starts_with($serverString, 'ldap://')) {","sourceCodeStart":271,"sourceCodeEnd":307,"githubUrl":"https://github.com/BookStackApp/BookStack/blob/18f8469a1c72f8cc8497e9372635e6dea5028071/app/Access/LdapService.php#L271-L307","documentation":"configureTlsCaCerts() validates the configured CA cert path with realpath(). If the path does not exist (or symlinks are broken), realpath() returns false and an LdapException is thrown before any LDAP connection is attempted. This is a configuration error surfaced early to fail fast.","triggerScenarios":"The LDAP TLS CA cert configuration value (LDAP_TLS_CA_CERT) points to a non-existent path; happens on every getConnection() call (via getUserWithAttributes, validateUserCredentials, getParentsOfGroup) while that config value is set.","commonSituations":"Typo in the .env path; container image without the CA file mounted; path valid on host but not inside Docker; typo'd or moved directory after upgrade; relative path resolved against unexpected working directory.","solutions":["Verify the path exists: run realpath /path/to/certs on the server/container running the app","Fix the LDAP_TLS_CA_CERT value in .env to an existing absolute path","Mount or copy the CA bundle into the container if running in Docker/Kubernetes","Ensure the web-server/PHP process user has permission to traverse the directory path","Clear any config cache (php artisan config:clear) so the corrected value is picked up"],"exampleFix":"// before (.env)\nLDAP_TLS_CA_CERT=/etc/ssl/certs/ldap-ca.cr\n// after\nLDAP_TLS_CA_CERT=/etc/ssl/certs/ldap-ca.crt","handlingStrategy":"validation","validationCode":"$caPath = config('services.ldap.tls_ca_cert');\nif ($caPath && (realpath($caPath) === false)) {\n    throw new RuntimeException(\"LDAP TLS CA path does not exist: {$caPath}\");\n}","typeGuard":"function isReadableCertPath(?string $path): bool {\n    return $path !== null && realpath($path) !== false && (is_dir($path) || is_file($path));\n}","tryCatchPattern":null,"preventionTips":["Use absolute paths in .env, never relative ones","In Docker, verify the CA file is mounted and readable by the PHP user","Add a deployment health check that realpath's configured cert paths","Run php artisan config:clear after changing cert paths"],"tags":["ldap","tls","configuration","path"],"backgroundTag":"missing-file-or-path","analyzedSha":"18f8469a1c72f8cc8497e9372635e6dea5028071","analyzedAt":"2026-09-02T19:49:33.068Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}