{"record":{"id":"1e67d11d9be1e8b1","repo":"passbolt/passbolt_api","slug":"provided-root-ca-file-does-not-exist","errorCode":null,"errorMessage":"Provided root CA file does not exist","messagePattern":"Provided root CA file does not exist","errorType":"validation","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Utility/Http/SsoHttpClientFactory.php","lineNumber":73,"sourceCode":"     * @return string|bool `true` for default verification, `false` to disable, or a CA file path.\n     * @throws \\Cake\\Http\\Exception\\BadRequestException When a custom CA file is configured but invalid.\n     */\n    private static function resolveVerify(): bool|string\n    {\n        $sslVerify = (bool)Configure::read(self::CONFIG_SSL_VERIFY, true);\n        $sslCafile = Configure::read(self::CONFIG_SSL_CAFILE);\n\n        if ($sslVerify && $sslCafile === null) {\n            return true;\n        }\n        if (!$sslVerify) {\n            return false;\n        }\n        if (!is_string($sslCafile)) {\n            throw new BadRequestException(__('Invalid value provided in `passbolt.security.sso.sslCafile` config'));\n        }\n        if (!file_exists($sslCafile)) {\n            throw new BadRequestException(__('Provided root CA file does not exist'));\n        }\n\n        return $sslCafile;\n    }\n}\n","sourceCodeStart":55,"sourceCodeEnd":79,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Utility/Http/SsoHttpClientFactory.php#L55-L79","documentation":"This BadRequestException is thrown by SsoHttpClientFactory::resolveVerify when the `passbolt.security.sso.sslCafile` config points to a path that does not exist on the server filesystem. The library validates the CA bundle path before wiring it into the HTTP client used for SSO/OAuth2 TLS verification, failing fast to avoid silent certificate trust issues later.","triggerScenarios":"Calling SsoHttpClientFactory::create() while `passbolt.security.sso.sslCafile` is set to a string path that passes the is_string check but fails file_exists() — e.g. a typo'd path, a deleted file, or a path valid on another machine/container.","commonSituations":"Admins copy config from docs where the CA path differs per OS (/etc/ssl/certs/ca-certificates.crt vs /etc/pki/tls/certs/ca-bundle.crt); Docker volumes not mounting the CA file; the file was removed during a base image change or cert package update.","solutions":["Check the configured path with `ls -l` on the server (inside the container if applicable) and fix `passbolt.security.sso.sslCafile` in config/passbolt.php or environment config to point at an existing CA bundle.","If no custom CA is needed, remove/unset the sslCafile config entry so resolveVerify returns early and uses system defaults.","If the CA file lives outside the container, mount it into the container and reference the in-container path.","Ensure the file is readable by the web-server/PHP user (existence also implies readable for file_exists, but verify permissions for fopen)."],"exampleFix":"// before\n'passbolt' => ['security' => ['sso' => ['sslCafile' => '/etc/ssl/custom-ca.pem']]], // file absent\n// after\n'passbolt' => ['security' => ['sso' => ['sslCafile' => '/etc/ssl/certs/ca-certificates.crt']]], // verified with ls","handlingStrategy":"validation","validationCode":"$cafile = Configure::read('passbolt.security.sso.sslCafile');\nif (is_string($cafile) && !file_exists($cafile)) {\n    throw new RuntimeException(\"sslCafile does not exist: $cafile\");\n}","typeGuard":"function isValidCafilePath(mixed $path): bool {\n    return is_string($path) && $path !== '' && file_exists($path) && is_readable($path);\n}","tryCatchPattern":"try {\n    $client = SsoHttpClientFactory::create();\n} catch (BadRequestException $e) {\n    // check passbolt.security.sso.sslCafile points to an existing file\n}","preventionTips":["Provision the CA file with deployment tooling and assert its existence in a pre-deploy health check","Use OS-conditional config for default CA bundle paths (Debian vs RHEL)","Mount CA files explicitly into containers and reference in-container paths"],"tags":["config","ssl","file-not-found","sso"],"backgroundTag":"file-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}