{"record":{"id":"2629874feeaf8e8c","repo":"temporalio/temporal","slug":"only-one-of-cadata-or-cafile-properties-should-be-262987","errorCode":null,"errorMessage":"only one of caData or caFile properties should be specified","messagePattern":"only one of caData or caFile properties should be specified","errorType":"validation","errorClass":"ErrTLSConfig","httpStatus":null,"severity":"error","filePath":"common/auth/tls_config_helper.go","lineNumber":135,"sourceCode":"}\n\nfunc validateTemporalTls(temporalTls *TLS) error {\n\tif temporalTls.CertData != \"\" && temporalTls.CertFile != \"\" {\n\t\treturn fmt.Errorf(\"%w: %s\", ErrTLSConfig, \"only one of certData or certFile properties should be specified\")\n\t}\n\n\tif temporalTls.KeyData != \"\" && temporalTls.KeyFile != \"\" {\n\t\treturn fmt.Errorf(\"%w: %s\", ErrTLSConfig, \"only one of keyData or keyFile properties should be specified\")\n\t}\n\n\tcertProvided := temporalTls.CertData != \"\" || temporalTls.CertFile != \"\"\n\tkeyProvided := temporalTls.KeyData != \"\" || temporalTls.KeyFile != \"\"\n\tif certProvided != keyProvided {\n\t\treturn fmt.Errorf(\"%w: %s\", ErrTLSConfig, \"cert or key is missing\")\n\t}\n\n\tif temporalTls.CaData != \"\" && temporalTls.CaFile != \"\" {\n\t\treturn fmt.Errorf(\"%w: %s\", ErrTLSConfig, \"only one of caData or caFile properties should be specified\")\n\t}\n\treturn nil\n}\n\nfunc parseCAs(temporalTls *TLS) (*x509.CertPool, error) {\n\tvar caBytes []byte\n\tvar err error\n\tif temporalTls.CaFile != \"\" {\n\t\tcaBytes, err = os.ReadFile(temporalTls.CaFile)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"%w: %s (%w)\", ErrTLSConfig, \"unable to read client ca file\", err)\n\t\t}\n\t} else if temporalTls.CaData != \"\" {\n\t\tcaBytes, err = base64.StdEncoding.DecodeString(temporalTls.CaData)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"%w: %s (%w)\", ErrTLSConfig, \"unable to decode client ca data\", err)\n\t\t}\n\t}","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/temporalio/temporal/blob/bde624efd13fbd3843654058db6d9c716166318b/common/auth/tls_config_helper.go#L117-L153","documentation":"This error is returned by validateTemporalTls when the CA certificate is supplied both inline (CaData) and via a file path (CaFile). Like the cert/key checks, the library requires a single CA source so it can deterministically build the x509.CertPool, wrapping the failure with ErrTLSConfig.","triggerScenarios":"Calling NewTLSConfig with a *TLS struct where both CaData != \"\" and CaFile != \"\" — typically from merged config layers or a templating error.","commonSituations":"Adding a custom CA via file mount while an inline CA remains from a base config; Helm/environment overlay injecting caData on top of caFile; example-config copy-paste filling both fields.","solutions":["Remove one field: keep caFile for on-disk PEM, or caData with base64-encoded PEM.","Trace the config merge to find where the duplicate CA source is added and unset it.","Fail fast in tests by asserting only one CA source is set per TLS block."],"exampleFix":"// before\ntls:\n  caData: \"LS0tLS1CRUdJTi...\"\n  caFile: \"/etc/temporal/certs/ca.pem\"\n// after\ntls:\n  caFile: \"/etc/temporal/certs/ca.pem\"","handlingStrategy":"validation","validationCode":"func validateTLSOneCaSource(t *auth.TLS) error {\n\tif t.CaData != \"\" && t.CaFile != \"\" {\n\t\treturn fmt.Errorf(\"set only one of caData or caFile\")\n\t}\n\treturn nil\n}","typeGuard":"func hasExactlyOne(a, b string) bool { return (a != \"\") != (b != \"\") }","tryCatchPattern":null,"preventionTips":["Pick a single CA delivery mechanism per environment and enforce it in config templates","Null out the old CA field in overrides when adding a new one","Include a config lint step in CI that flags both *Data and *File set simultaneously"],"tags":["tls","config","validation"],"backgroundTag":"tls-config-conflict","analyzedSha":"bde624efd13fbd3843654058db6d9c716166318b","analyzedAt":"2026-09-01T07:18:39.080Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}