{"record":{"id":"3c57010ee6a011c0","repo":"fluent/fluentd","slug":"ca-private-key-path-is-required-when-ca-cert-path","errorCode":null,"errorMessage":"ca_private_key_path is required when ca_cert_path is specified","messagePattern":"ca_private_key_path is required when ca_cert_path is specified","errorType":"exception","errorClass":"Fluent::ConfigError","httpStatus":null,"severity":"error","filePath":"lib/fluent/plugin_helper/cert_option.rb","lineNumber":76,"sourceCode":"                                  sandbox.instance_eval(conf.cert_verifier)\n                                end\n        end\n\n        Fluent::TLS.set_version_to_context(ctx, version, conf.min_version, conf.max_version)\n        ctx.ciphers = ciphers unless insecure\n\n        ctx\n      end\n\n      def cert_option_server_validate!(conf)\n        case\n        when conf.cert_path\n          raise Fluent::ConfigError, \"private_key_path is required when cert_path is specified\" unless conf.private_key_path\n          log.warn \"For security reason, setting private_key_passphrase is recommended when cert_path is specified\" unless conf.private_key_passphrase\n          cert_option_load(conf.cert_path, conf.private_key_path, conf.private_key_passphrase)\n\n        when conf.ca_cert_path\n          raise Fluent::ConfigError, \"ca_private_key_path is required when ca_cert_path is specified\" unless conf.ca_private_key_path\n          log.warn \"For security reason, setting ca_private_key_passphrase is recommended when ca_cert_path is specified\" unless conf.ca_private_key_passphrase\n          generate_opts = cert_option_cert_generation_opts_from_conf(conf)\n          cert_option_generate_server_pair_by_ca(\n            conf.ca_cert_path,\n            conf.ca_private_key_path,\n            conf.ca_private_key_passphrase,\n            generate_opts\n          )\n\n        when conf.insecure\n          log.warn \"insecure TLS communication server is configured (using 'insecure' mode)\"\n          generate_opts = cert_option_cert_generation_opts_from_conf(conf)\n          cert_option_generate_server_pair_self_signed(generate_opts)\n\n        else\n          raise Fluent::ConfigError, \"no valid cert options configured. specify either 'cert_path', 'ca_cert_path' or 'insecure'\"\n        end\n      end","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/fluent/fluentd/blob/dd45c6e18dc7be33b5e5a0f0767bf46307ff5626/lib/fluent/plugin_helper/cert_option.rb#L58-L94","documentation":"In cert_option_server_validate! (cert_option.rb:75-77), when <transport tls> is configured with ca_cert_path (use a CA to sign a server certificate on the fly), the CA's private key ca_private_key_path is mandatory: fluentd generates a fresh server certificate at startup and signs it with the CA key. Without ca_private_key_path the signing operation is impossible, so configuration fails immediately with this Fluent::ConfigError.","triggerScenarios":"A <transport tls> block containing ca_cert_path /etc/fluent/ca.pem but no ca_private_key_path. Also happens when an operator confuses the two modes and supplies a server cert_path-less config mixing client-side ca_path terminology with the server-side ca_cert_path option.","commonSituations":"Setting up fluentd-to-fluentd forwarding where the output config declares a CA cert; operators supplying only the public CA certificate copied from the CA host; secret-management pipelines that provision CA certs but restrict CA keys, forgetting the forwarder needs the key to mint server certs.","solutions":["Add ca_private_key_path /etc/fluent/ca-key.pem alongside ca_cert_path in <transport tls>","Confirm the CA key is readable by the fluentd user and matches the CA cert (compare modulus via openssl rsa / openssl x509)","If the CA private key genuinely cannot live on this node, switch modes: use cert_path + private_key_path with a pre-issued server certificate instead of CA-signed generation","Set ca_private_key_passphrase too if the CA key is encrypted (fluentd also warns when it is absent)"],"exampleFix":"# before\n<transport tls>\n  ca_cert_path /etc/fluent/ca-cert.pem\n</transport>\n# => ca_private_key_path is required when ca_cert_path is specified\n\n# after\n<transport tls>\n  ca_cert_path /etc/fluent/ca-cert.pem\n  ca_private_key_path /etc/fluent/ca-key.pem\n</transport>","handlingStrategy":"validation","validationCode":"tls = { 'ca_cert_path' => '/etc/fluent/ca.pem', 'ca_private_key_path' => '/etc/fluent/ca.key' }\nraise 'ca_private_key_path missing' if tls['ca_cert_path'] && !tls['ca_private_key_path']","typeGuard":null,"tryCatchPattern":"begin\n  agent.configure(conf)\nrescue Fluent::ConfigError => e\n  if e.message.include?('ca_private_key_path is required')\n    abort 'supply the CA key, or switch to a pre-issued cert_path/private_key_path pair'\n  end\n  raise\nend","preventionTips":["Document internally that ca_cert_path mode requires the CA's private key on the node — it signs server certs at startup","If policy forbids shipping CA keys, pre-issue server certs and use cert_path + private_key_path instead","Dry-run configs whenever TLS mode changes (CA-signed vs pre-issued vs insecure)"],"tags":["fluentd","tls","certificate","certificate-authority","private-key","config-error","startup"],"backgroundTag":"tls-missing-private-key","analyzedSha":"dd45c6e18dc7be33b5e5a0f0767bf46307ff5626","analyzedAt":"2026-08-21T16:22:07.332Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}