{"record":{"id":"20664ce0164c58cc","repo":"oauth2-proxy/oauth2-proxy","slug":"systemcertpool-is-empty","errorCode":null,"errorMessage":"SystemCertPool is empty","messagePattern":"SystemCertPool is empty","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/util/util.go","lineNumber":47,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"unable to get SystemCertPool when append is true - #{err}\")\n\t\t}\n\t\tpool = rootPool\n\t} else {\n\t\tpool = x509.NewCertPool()\n\t}\n\n\treturn loadCertsFromPaths(paths, pool)\n\n}\n\nfunc getSystemCertPool() (*x509.CertPool, error) {\n\trootPool, err := x509.SystemCertPool()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif rootPool == nil {\n\t\treturn nil, fmt.Errorf(\"SystemCertPool is empty\")\n\t}\n\n\treturn rootPool, nil\n}\n\nfunc loadCertsFromPaths(paths []string, pool *x509.CertPool) (*x509.CertPool, error) {\n\tfor _, path := range paths {\n\t\t// Cert paths are a configurable option\n\t\tdata, err := os.ReadFile(path) // #nosec G304\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"certificate authority file (%s) could not be read - %s\", path, err)\n\t\t}\n\t\tif !pool.AppendCertsFromPEM(data) {\n\t\t\treturn nil, fmt.Errorf(\"loading certificate authority (%s) failed\", path)\n\t\t}\n\t}\n\treturn pool, nil\n}","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/oauth2-proxy/oauth2-proxy/blob/33c2eb92dea78204f7a18bc2dfdbccc220f39257/pkg/util/util.go#L29-L65","documentation":"getSystemCertPool wraps x509.SystemCertPool() and returns this error when Go's certificate pool comes back nil instead of a usable (possibly empty) pool. On some platforms (notably older Go versions on Windows or stripped-down Linux images) the system root store cannot be loaded, yielding a nil pool. The library refuses to continue building a TLS trust pool from nothing.","triggerScenarios":"GetCertPool -> getSystemCertPool when x509.SystemCertPool() returns (nil, nil), which happens on platforms where the system cert store is unavailable or on Go versions with platform-specific cert-loading bugs.","commonSituations":"Running in a minimal/alpine or scratch Docker image without ca-certificates installed; Windows or macOS with an empty/unreadable system trust store; older Go runtimes with known x509 SystemCertPool bugs.","solutions":["Install system CA certificates (e.g. apt-get install ca-certificates or apk add ca-certificates) so the system trust store exists","Upgrade Go to a recent version where x509.SystemCertPool reliably returns a non-nil pool","Pass explicit CA file paths via the cert pool path configuration so pool construction does not depend on the system store","Check the underlying x509 error returned before this message for the real platform cause"],"exampleFix":"// before\nrootPool, err := x509.SystemCertPool()\nif err != nil {\n    return nil, err\n}\n// after (fallback to an empty pool and load explicit CAs)\nrootPool, err := x509.SystemCertPool()\nif err != nil || rootPool == nil {\n    rootPool = x509.NewCertPool()\n}","handlingStrategy":"validation","validationCode":"if _, err := x509.SystemCertPool(); err != nil || rootPoolNil() { /* install CA certs before starting */ }\nfunc rootPoolNil() bool { p, _ := x509.SystemCertPool(); return p == nil }","typeGuard":"func systemPoolAvailable() bool { p, _ := x509.SystemCertPool(); return p != nil }","tryCatchPattern":null,"preventionTips":["Install ca-certificates in container images","Pin a recent Go version","Configure explicit CA file paths as a fallback"],"tags":["tls","x509","certificates","configuration"],"backgroundTag":"missing-env-var","analyzedSha":"33c2eb92dea78204f7a18bc2dfdbccc220f39257","analyzedAt":"2026-09-06T08:51:53.077Z","contentChangedAt":"2026-09-06T08:51:53.077Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}