{"record":{"id":"13646678eba77ac8","repo":"risingwavelabs/risingwave","slug":"read-ca-file-error-0","errorCode":null,"errorMessage":"read ca file error: {0}","messagePattern":"read ca file error: (.+?)","errorType":"exception","errorClass":"SchemaRegistryClientError::ReadFile","httpStatus":null,"severity":"error","filePath":"src/connector/src/schema/schema_registry/client.rs","lineNumber":130,"sourceCode":"    password: Option<String>,\n\n    retry_config: SchemaRegistryRetryConfig,\n}\n\n#[derive(Debug, thiserror::Error)]\n#[error(\"all request confluent registry all timeout, {context}\\n{}\", errs.iter().map(|e| format!(\"\\t{}\", e.as_report())).join(\"\\n\"))]\npub struct ConcurrentRequestError {\n    errs: Vec<itertools::Either<RequestError, tokio::task::JoinError>>,\n    context: String,\n}\n\ntype SrResult<T> = Result<T, ConcurrentRequestError>;\n\n#[derive(thiserror::Error, Debug)]\npub enum SchemaRegistryClientError {\n    #[error(transparent)]\n    InvalidOption(#[from] InvalidOptionError),\n    #[error(\"read ca file error: {0}\")]\n    ReadFile(#[source] std::io::Error),\n    #[error(\"parse ca file error: {0}\")]\n    ParsePem(#[source] reqwest::Error),\n    #[error(\"build schema registry client error: {0}\")]\n    Build(#[source] reqwest::Error),\n}\n\nimpl TryFrom<&ConfluentSchemaRegistryConnection> for Client {\n    type Error = InvalidOptionError;\n\n    fn try_from(value: &ConfluentSchemaRegistryConnection) -> Result<Self, Self::Error> {\n        let urls = handle_sr_list(value.url.as_str())?;\n\n        Client::new(\n            urls,\n            &SchemaRegistryConfig {\n                username: value.username.clone(),\n                password: value.password.clone(),","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/connector/src/schema/schema_registry/client.rs#L112-L148","documentation":"SchemaRegistryClientError::ReadFile is returned when the CA certificate file configured for the schema registry TLS connection cannot be read from disk. It wraps the underlying std::io::Error (e.g. NotFound, PermissionDenied). The client builds an reqwest TLS config from this PEM file, so it fails before any network request is made.","triggerScenarios":"Constructing a schema registry Client via TryFrom<&ConfluentSchemaRegistryConnection> when the connection specifies a CA certificate path whose file cannot be opened/read (std::fs::read fails).","commonSituations":"Typo in the CA cert path, file not mounted into the container, missing read permissions, or the file was deleted/moved after config was written.","solutions":["Verify the CA file path exists and is readable: ls -l <path> and cat <path> | head.","Mount the CA certificate into the container/pod or fix the path in the connection options.","Fix file permissions so the RisingWave process user can read it.","If no custom CA is actually needed, remove the CA option so the system trust store is used."],"exampleFix":"// before (client.rs)\nlet ca = std::fs::read(&ca_path)?;\n// after (defensive check in caller)\nassert!(std::path::Path::new(\"/certs/ca.pem\").exists(), \"CA file missing\");\nlet ca = std::fs::read(\"/certs/ca.pem\")?;","handlingStrategy":"validation","validationCode":"let path = std::path::Path::new(&ca_path);\nif !path.is_file() {\n    return Err(format!(\"CA file not found or not a file: {}\", ca_path));\n}\nstd::fs::File::open(path)?.metadata()?; // open-check before client build","typeGuard":null,"tryCatchPattern":"match build_client(conn) {\n    Ok(c) => c,\n    Err(SchemaRegistryClientError::ReadFile(io)) => {\n        eprintln!(\"CA file unreadable: {}\", io); return Err(io.into());\n    }\n    Err(e) => return Err(e.into()),\n}","preventionTips":["Mount CA certs into containers at stable paths.","Validate cert paths in deployment configs/CI.","Keep cert files readable by the process user.","Prefer system trust store when no custom CA is required."],"tags":["tls","filesystem","schema-registry"],"backgroundTag":"file-read-failed","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}