{"record":{"id":"4b3996401d7bcb3c","repo":"zeroclaw-labs/zeroclaw","slug":"mcp-server-tls-ca-certificate-path-must-be-a","errorCode":null,"errorMessage":"MCP server `{}`: TLS CA certificate path must be absolute: `{}`","messagePattern":"MCP server `(.+?)`: TLS CA certificate path must be absolute: `(.+?)`","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-tools/src/mcp_transport.rs","lineNumber":191,"sourceCode":"\n    if let Some(path) = config.tls_ca_cert_path.as_deref() {\n        let server_name = config.name.clone();\n        builder = builder.redirect(reqwest::redirect::Policy::custom(move |attempt| {\n            if attempt.previous().len() >= 10 {\n                attempt.error(std::io::Error::other(format!(\n                    \"MCP server `{server_name}`: too many redirects\"\n                )))\n            } else if attempt.url().scheme() == \"https\" {\n                attempt.follow()\n            } else {\n                attempt.error(std::io::Error::other(format!(\n                    \"MCP server `{server_name}`: tls_ca_cert_path forbids redirecting to plaintext\"\n                )))\n            }\n        }));\n\n        if !std::path::Path::new(path).is_absolute() {\n            bail!(\n                \"MCP server `{}`: TLS CA certificate path must be absolute: `{}`\",\n                config.name,\n                path\n            );\n        }\n\n        let pem = load_tls_ca_pem(config, path)?;\n        let certificates = reqwest::Certificate::from_pem_bundle(&pem).with_context(|| {\n            format!(\n                \"MCP server `{}`: invalid PEM CA certificate at `{}`\",\n                config.name, path\n            )\n        })?;\n        if certificates.is_empty() {\n            bail!(\n                \"MCP server `{}`: CA certificate file `{}` contained no certificates\",\n                config.name,\n                path","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-tools/src/mcp_transport.rs#L173-L209","documentation":"Error \"MCP server `{}`: TLS CA certificate path must be absolute: `{}`\" thrown in zeroclaw-labs/zeroclaw.","triggerScenarios":"Thrown at crates/zeroclaw-tools/src/mcp_transport.rs:191 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use an absolute path for the MCP server's TLS CA certificate."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}