{"record":{"id":"279ccf65f59cc645","repo":"thanos-io/thanos","slug":"unable-to-load-specified-ca-cert-s-s","errorCode":null,"errorMessage":"unable to load specified CA cert %s: %s","messagePattern":"unable to load specified CA cert (.+?): (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/exthttp/tlsconfig.go","lineNumber":65,"sourceCode":"\t\treturn nil, fmt.Errorf(\"client cert file %q specified without client key file\", cfg.CertFile)\n\t} else if len(cfg.KeyFile) > 0 && len(cfg.CertFile) == 0 {\n\t\treturn nil, fmt.Errorf(\"client key file %q specified without client cert file\", cfg.KeyFile)\n\t} else if len(cfg.CertFile) > 0 && len(cfg.KeyFile) > 0 {\n\t\t// Verify that client cert and key are valid.\n\t\tif _, err := cfg.getClientCertificate(nil); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\ttlsConfig.GetClientCertificate = cfg.getClientCertificate\n\t}\n\n\treturn tlsConfig, nil\n}\n\n// readCAFile reads the CA cert file from disk.\nfunc readCAFile(f string) ([]byte, error) {\n\tdata, err := os.ReadFile(f)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to load specified CA cert %s: %s\", f, err)\n\t}\n\treturn data, nil\n}\n\n// updateRootCA parses the given byte slice as a series of PEM encoded certificates and updates tls.Config.RootCAs.\nfunc updateRootCA(cfg *tls.Config, b []byte) bool {\n\tcaCertPool := x509.NewCertPool()\n\tif !caCertPool.AppendCertsFromPEM(b) {\n\t\treturn false\n\t}\n\tcfg.RootCAs = caCertPool\n\treturn true\n}\n\n// getClientCertificate reads the pair of client cert and key from disk and returns a tls.Certificate.\nfunc (c *TLSConfig) getClientCertificate(*tls.CertificateRequestInfo) (*tls.Certificate, error) {\n\tcert, err := tls.LoadX509KeyPair(c.CertFile, c.KeyFile)\n\tif err != nil {","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/thanos-io/thanos/blob/35b8b991177def87ed52dcf10f9b6d87f07282c8/pkg/exthttp/tlsconfig.go#L47-L83","documentation":"The error produced by readCAFile when the configured CA bundle (tls_configs.ca_file) cannot be loaded — the file is unreadable, empty, or does not contain parseable PEM certificates. The path and underlying error are interpolated; the TLS config is rejected before use.","triggerScenarios":"Thrown at pkg/exthttp/tlsconfig.go:65 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the ca-file path exists and is readable by the process.","Mount the secret/configmap correctly (Kubernetes).","Fix the path; startup-time config errors are not retryable in place."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"35b8b991177def87ed52dcf10f9b6d87f07282c8","analyzedAt":"2026-09-07T01:49:59.689Z","contentChangedAt":"2026-09-07T01:49:59.689Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}