{"record":{"id":"22d45dd97138c0a5","repo":"temporalio/temporal","slug":"failed-to-append-ca-file","errorCode":null,"errorMessage":"failed to append CA file","messagePattern":"failed to append CA file","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/persistence/sql/sqlplugin/mysql/session/session.go","lineNumber":219,"sourceCode":"\t}\n}\n\nfunc registerTLSConfig(cfg *config.SQL) error {\n\tif cfg.TLS == nil || !cfg.TLS.Enabled {\n\t\treturn nil\n\t}\n\n\t// TODO: create a way to set MinVersion and CipherSuites via cfg.\n\ttlsConfig := auth.NewTLSConfigForServer(cfg.TLS.ServerName, cfg.TLS.EnableHostVerification)\n\n\tif cfg.TLS.CaFile != \"\" {\n\t\trootCertPool := x509.NewCertPool()\n\t\tpem, err := os.ReadFile(cfg.TLS.CaFile)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to load CA files: %v\", err)\n\t\t}\n\t\tif ok := rootCertPool.AppendCertsFromPEM(pem); !ok {\n\t\t\treturn fmt.Errorf(\"failed to append CA file\")\n\t\t}\n\t\ttlsConfig.RootCAs = rootCertPool\n\t}\n\n\tif cfg.TLS.CertFile != \"\" && cfg.TLS.KeyFile != \"\" {\n\t\tclientCert := make([]tls.Certificate, 0, 1)\n\t\tcerts, err := tls.LoadX509KeyPair(\n\t\t\tcfg.TLS.CertFile,\n\t\t\tcfg.TLS.KeyFile,\n\t\t)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to load tls x509 key pair: %v\", err)\n\t\t}\n\t\tclientCert = append(clientCert, certs)\n\t\ttlsConfig.Certificates = clientCert\n\t}\n\n\t// In order to use the TLS configuration you need to register it. Once registered you use it by specifying","sourceCodeStart":201,"sourceCodeEnd":237,"githubUrl":"https://github.com/temporalio/temporal/blob/bde624efd13fbd3843654058db6d9c716166318b/common/persistence/sql/sqlplugin/mysql/session/session.go#L201-L237","documentation":"After the CA file is read successfully, registerTLSConfig parses it with x509.AppendCertsFromPEM; if no certificates could be parsed from the bytes, it returns \"failed to append CA file\". This means the file exists but does not contain any valid PEM-encoded certificates.","triggerScenarios":"createConnection -> registerTLSConfig where TLS.CaFile points to an existing file whose contents are not parseable PEM certificates (empty file, wrong format, DER-encoded cert, concatenated junk).","commonSituations":"Secret mounted as an empty/placeholder file; DER (.crt binary) cert provided instead of PEM; file containing a private key or chain without the CA cert; truncation during secret provisioning; YAML inlining mangling the PEM.","solutions":["Verify the file contains PEM blocks (-----BEGIN CERTIFICATE-----) with: openssl x509 -in ca.pem -text -noout.","Convert DER certificates to PEM: openssl x509 -inform der -in ca.crt -out ca.pem.","Re-create/re-mount the secret and confirm the file is non-empty and uncorrupted inside the container.","Concatenate the full CA chain (intermediates + root) into the file if the server uses an intermediate chain."],"exampleFix":"// before: ca.pem contains a DER binary certificate\n// convert it\nopenssl x509 -inform der -in ca.crt -out /etc/temporal/certs/ca.pem\n// after: ca.pem starts with\n// -----BEGIN CERTIFICATE-----","handlingStrategy":"validation","validationCode":"pemBytes, err := os.ReadFile(cfg.TLS.CaFile)\nif err != nil { return err }\nif !x509.NewCertPool().AppendCertsFromPEM(pemBytes) {\n    return fmt.Errorf(\"file %q contains no valid PEM certificates\", cfg.TLS.CaFile)\n}","typeGuard":"func isValidPEMCA(path string) bool {\n    b, err := os.ReadFile(path)\n    if err != nil { return false }\n    return x509.NewCertPool().AppendCertsFromPEM(b)\n}","tryCatchPattern":"if err := connectDB(cfg); err != nil {\n    if strings.Contains(err.Error(), \"failed to append CA file\") {\n        // convert cert to PEM (openssl x509 -inform der ...) and retest\n    }\n    return err\n}","preventionTips":["Always supply PEM (not DER) certificates; verify with openssl x509 -in ca.pem -text -noout.","Confirm mounted secrets are non-empty inside the container before starting services.","Include the full CA chain (intermediates plus root) in the CA file."],"tags":["tls","mysql","certificates","configuration"],"backgroundTag":"invalid-pem-certificate","analyzedSha":"bde624efd13fbd3843654058db6d9c716166318b","analyzedAt":"2026-09-01T07:18:39.080Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}