{"record":{"id":"4c2c95018bce0499","repo":"apple/pkl","slug":"cannotfindcertfile","errorCode":"cannotFindCertFile","errorMessage":"cannotFindCertFile: ${file}","messagePattern":"cannotFindCertFile: (.+?)","errorType":"exception","errorClass":"HttpClientException","httpStatus":null,"severity":"error","filePath":"pkl-core/src/main/java/org/pkl/core/http/JdkHttpClient.java","lineNumber":162,"sourceCode":"\n      var sslContext = SSLContext.getInstance(\"TLS\");\n      sslContext.init(null, trustManagerFactory.getTrustManagers(), new SecureRandom());\n\n      return sslContext;\n    } catch (GeneralSecurityException | IOException e) {\n      throw new HttpClientException(\n          ErrorMessages.create(\"cannotInitHttpClient\", Exceptions.getRootReason(e)), e);\n    }\n  }\n\n  private static List<Certificate> gatherCertificates(\n      CertificateFactory factory, List<Path> certificateFiles, List<ByteBuffer> certificateBytes) {\n    var certificates = new ArrayList<Certificate>();\n    for (var file : certificateFiles) {\n      try (var stream = Files.newInputStream(file)) {\n        collectCertificates(certificates, factory, stream, file);\n      } catch (NoSuchFileException e) {\n        throw new HttpClientException(ErrorMessages.create(\"cannotFindCertFile\", file));\n      } catch (IOException e) {\n        throw new HttpClientException(\n            ErrorMessages.create(\"cannotReadCertFile\", Exceptions.getRootReason(e)));\n      }\n    }\n    for (var byteBuffer : certificateBytes) {\n      var stream = new ByteArrayInputStream(byteBuffer.array());\n      collectCertificates(certificates, factory, stream, \"<unavailable>\");\n    }\n    return certificates;\n  }\n\n  private static void collectCertificates(\n      ArrayList<Certificate> anchors,\n      CertificateFactory factory,\n      InputStream stream,\n      Object source) {\n    var input = new PushbackInputStream(stream);","sourceCodeStart":144,"sourceCodeEnd":180,"githubUrl":"https://github.com/apple/pkl/blob/f3efcbfc9b60d30053b0536d664948d7aa1b8673/pkl-core/src/main/java/org/pkl/core/http/JdkHttpClient.java#L144-L180","documentation":"Pkl's HTTP client was asked to use TLS certificates from a file path that does not exist. The client gathers certificates during construction of the HTTP session and throws HttpClientException wrapped around this error when a configured certificate file cannot be found on disk. It is a configuration/resource error, not a network error.","triggerScenarios":"Passing a certificate file path via HTTP client configuration options (e.g. certificateFiles for an HTTP proxy or external module) where the path does not exist on disk; Files.newInputStream throws NoSuchFileException in gatherCertificates (called from certs) and Pkl maps it to cannotFindCertFile.","commonSituations":"Typo in a cert path in project config, running Pkl on a machine or container where the cert bundle was never installed, relative path resolved against an unexpected working directory, or certs deleted after configuration was written.","solutions":["Verify the certificate file path exists (e.g. `ls -l <path>`) and fix the path in the Pkl HTTP configuration.","Use an absolute path to avoid surprises from the process working directory.","If the cert comes from a package/system bundle (e.g. /etc/ssl/certs/ca-certificates.crt), install the CA certificate package in the environment.","If certificates are provided as bytes instead, use the certificate-bytes option so no file lookup occurs."],"exampleFix":"// before (pkl)\nhttp {\n  proxy { address = ...; certificateFile = \"/etc/ssl/certs/my-ca.pem\" } // file missing\n}\n// after (pkl)\nhttp {\n  proxy { address = ...; certificateFile = \"/etc/ssl/certs/ca-certificates.crt\" } // verified existing\n}","handlingStrategy":"validation","validationCode":"Path certFile = Paths.get(\"/etc/ssl/certs/custom-ca.pem\");\nif (!Files.isRegularFile(certFile)) {\n  throw new IllegalStateException(\"Certificate file missing: \" + certFile);\n}\nif (!Files.isReadable(certFile)) {\n  throw new IllegalStateException(\"Certificate file not readable: \" + certFile);\n}","typeGuard":null,"tryCatchPattern":"try {\n  // run Pkl / build the HTTP client\n} catch (HttpClientException e) {\n  if (e.getMessage().startsWith(\"cannotFindCertFile\")) {\n    // fall back to default trust store or fix the path\n  }\n}","preventionTips":["Use absolute paths for certificate files in configuration.","Verify cert paths exist in CI before shipping configuration.","Package certificates into your container/image and assert their presence at startup.","Prefer certificate bytes over file paths when certs come from a secret manager."],"tags":["http","tls","configuration","file-not-found"],"backgroundTag":"file-not-found","analyzedSha":"f3efcbfc9b60d30053b0536d664948d7aa1b8673","analyzedAt":"2026-09-08T13:10:45.570Z","contentChangedAt":"2026-09-08T13:10:45.570Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}