{"record":{"id":"25faeca91a56de23","repo":"NationalSecurityAgency/ghidra","slug":"is-not-a-valid-certification-authority","errorCode":null,"errorMessage":"{} is not a valid certification authority","messagePattern":"(.+?) is not a valid certification authority","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/BSimControlLaunchable.java","lineNumber":849,"sourceCode":"\t\t\thostAuthentication = AUTHENTICATION_PASSWORD;\n\t\t}\n\t\telse if (hostMethod.equals(CERTIFICATE_METHOD)) {\n\t\t\thostAuthentication = AUTHENTICATION_PKI;\n\t\t}\n\t}\n\n\t/**\n\t * Make sure certificate authority needed for pki was provided by user, otherwise throw exception\n\t * @throws IOException if the cert file is invalid\n\t * @throws GeneralSecurityException if the cert file is not a valid certificate\n\t */\n\tprivate void checkCertAuthorityFile() throws IOException, GeneralSecurityException {\n\t\tif (certAuthorityFile == null) {\n\t\t\tthrow new IOException(\n\t\t\t\t\"PKI authentication requested, but certificate authority file not provided\");\n\t\t}\n\t\tif (!certAuthorityFile.isFile()) {\n\t\t\tthrow new IOException(\n\t\t\t\tcertAuthorityFile.getAbsolutePath() + \" is not a valid certification authority\");\n\t\t}\n\t\tif (!verifyPEMFormat(certAuthorityFile)) {\n\t\t\tthrow new GeneralSecurityException(\n\t\t\t\t\"File \" + certAuthorityFile.getName() + \" does not appear to be a certificate\");\n\t\t}\n\t}\n\n\t/**\n\t * Locate the PostgreSQL configuration and authentication files (postgresql.conf and pg_hba.conf)\n\t * and recover the settings pertinent to BSimControl.  If the data directory has not been initialized yet,\n\t * run PostgreSQL's init command to perform the initialization and then tailor the configuration\n\t * based on BSimControl's command-line options and the Ghidra specific configuration options\n\t * @throws IOException if the module data file cannot be retrieved\n\t * @throws InterruptedException if the postgres command is interrupted\n\t * @throws SAXException if tuneConfig fails\n\t * @throws GeneralSecurityException if the cert file cannot be processed\n\t */","sourceCodeStart":831,"sourceCodeEnd":867,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/BSimControlLaunchable.java#L831-L867","documentation":"Thrown by checkCertAuthorityFile() when the path passed to --cafile resolves to something that is not a regular file (File.isFile() returns false: missing, a directory, or a broken symlink). BSim needs an actual CA file to copy into the data directory as root.crt for PostgreSQL client-cert verification.","triggerScenarios":"Passing `--cafile /path/that/does/not/exist` or pointing --cafile at a directory. The isFile() guard fires before any PEM content check.","commonSituations":"Typo in the CA path; relative path evaluated from the wrong working directory; CA file not yet generated/provisioned; pointing at the directory containing the cert instead of the cert file itself.","solutions":["Check the path exists and is a file: `ls -l <cafile>` and confirm it is not a directory.","Use an absolute path for --cafile to avoid working-directory ambiguity.","Provision or regenerate the CA root certificate before running the command.","Ensure the Ghidra process has read permission on the file."],"exampleFix":"// before\nbsim_ctl start --auth cert --cafile /etc/bsim\n// after\nbsim_ctl start --auth cert --cafile /etc/bsim/root.crt","handlingStrategy":"validation","validationCode":"File ca = new File(caFilePath);\nif (!ca.isFile()) {\n    throw new IllegalArgumentException(\n        \"--cafile path is not a regular file: \" + ca.getAbsolutePath());\n}","typeGuard":"public boolean isReadableCertFile(File f) {\n    return f != null && f.isFile() && f.canRead();\n}","tryCatchPattern":"try {\n    bsimControl.start(args);\n} catch (IOException e) {\n    if (e.getMessage() != null && e.getMessage().endsWith(\"is not a valid certification authority\")) {\n        throw new UserFacingException(\"CA file missing or not a file: \" + caFilePath, e);\n    }\n    throw e;\n}","preventionTips":["Always pass absolute paths for --cafile.","Pre-check the file with a small wrapper before invoking bsim_ctl.","Provision the CA file from config management so the path is stable."],"tags":["pki","authentication","file-system","configuration","bsim","cli"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}