{"record":{"id":"3efca63978278d5c","repo":"gravitational/teleport","slug":"file-q-contains-an-invalid-x509-certificate-w","errorCode":null,"errorMessage":"file %q contains an invalid x509 certificate: %w","messagePattern":"file %q contains an invalid x509 certificate: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/config/fileconf.go","lineNumber":1537,"sourceCode":"\t}\n\treturn res, nil\n}\n\nfunc getCertificatePEM(certOrPath string) (string, error) {\n\t_, parseErr := tlsutils.ParseCertificatePEM([]byte(certOrPath))\n\tif parseErr == nil {\n\t\treturn certOrPath, nil // OK, valid inline PEM\n\t}\n\n\t// Try reading as a file and parsing that.\n\tdata, err := os.ReadFile(certOrPath)\n\tif err != nil {\n\t\t// Don't use trace in order to keep a clean error message.\n\t\treturn \"\", fmt.Errorf(\"%q is not a valid x509 certificate (%w) and can't be read as a file (%w)\", certOrPath, parseErr, err)\n\t}\n\tif _, err := tlsutils.ParseCertificatePEM(data); err != nil {\n\t\t// Don't use trace in order to keep a clean error message.\n\t\treturn \"\", fmt.Errorf(\"file %q contains an invalid x509 certificate: %w\", certOrPath, err)\n\t}\n\n\treturn string(data), nil // OK, valid PEM file\n}\n\n// DeviceTrust holds settings related to trusted device verification.\n// Requires Teleport Enterprise.\ntype DeviceTrust struct {\n\t// Mode is the trusted device verification mode.\n\t// Mirrors types.DeviceTrust.Mode.\n\tMode string `yaml:\"mode,omitempty\"`\n\t// AutoEnroll is the toggle for the device auto-enroll feature.\n\tAutoEnroll string `yaml:\"auto_enroll,omitempty\"`\n\t// EKCertAllowedCAs is an allow list of EKCert CAs. These may be specified\n\t// as a PEM encoded certificate or as a path to a PEM encoded certificate.\n\t//\n\t// If present, only TPM devices that present an EKCert that is signed by a\n\t// CA specified here may be enrolled (existing enrollments are","sourceCodeStart":1519,"sourceCodeEnd":1555,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/config/fileconf.go#L1519-L1555","documentation":"Validation error from getCertificatePEM in the file config loader. The given certOrPath value was neither a valid inline PEM x509 certificate nor a readable file containing one (os.ReadFile failed, or the file's contents failed ParseCertificatePEM). It fires while parsing Teleport file configs (e.g. server/app definitions) whose cert field is malformed or points to a missing/unreadable path.","triggerScenarios":"Thrown at lib/config/fileconf.go:1537 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the file contains a complete, valid PEM certificate (correct BEGIN/END CERTIFICATE lines, no truncation)","Check for accidental inclusion of private keys or wrong files in the config","Regenerate or re-download the certificate"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}