{"record":{"id":"4e6b0588bad45db7","repo":"juicedata/juicefs","slug":"error-loading-ca-cert-file-s","errorCode":null,"errorMessage":"error loading CA cert file: %s","messagePattern":"error loading CA cert file: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/format.go","lineNumber":267,"sourceCode":"\t\t\t}\n\t\t\tobject.GetHttpClient().Transport.(*http.Transport).TLSClientConfig.InsecureSkipVerify = tlsSkipVerify\n\t\t\tvalues.Del(\"tls-insecure-skip-verify\")\n\t\t\tu.RawQuery = values.Encode()\n\t\t\tformat.Bucket = u.String()\n\t\t}\n\n\t\t// Configure client TLS when params are provided\n\t\tif values.Get(\"ca-certs\") != \"\" && values.Get(\"ssl-cert\") != \"\" && values.Get(\"ssl-key\") != \"\" {\n\n\t\t\tclientTLSCert, err := tls.LoadX509KeyPair(values.Get(\"ssl-cert\"), values.Get(\"ssl-key\"))\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error loading certificate and key file: %s\", err.Error())\n\t\t\t}\n\n\t\t\tcertPool := x509.NewCertPool()\n\t\t\tcaCertPEM, err := os.ReadFile(values.Get(\"ca-certs\"))\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error loading CA cert file: %s\", err.Error())\n\t\t\t}\n\n\t\t\tif certAdded := certPool.AppendCertsFromPEM(caCertPEM); !certAdded {\n\t\t\t\treturn nil, fmt.Errorf(\"error appending CA cert to pool\")\n\t\t\t}\n\n\t\t\tobject.GetHttpClient().Transport.(*http.Transport).TLSClientConfig.RootCAs = certPool\n\t\t\tobject.GetHttpClient().Transport.(*http.Transport).TLSClientConfig.Certificates = []tls.Certificate{clientTLSCert}\n\t\t}\n\t}\n\n\tif format.Shards > 1 {\n\t\tblob, err = object.NewSharded(strings.ToLower(format.Storage), format.Bucket, format.AccessKey, format.SecretKey, format.SessionToken, format.Shards)\n\t} else {\n\t\tblob, err = object.CreateStorage(strings.ToLower(format.Storage), format.Bucket, format.AccessKey, format.SecretKey, format.SessionToken)\n\t}\n\tif err != nil {\n\t\treturn nil, err","sourceCodeStart":249,"sourceCodeEnd":285,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/cmd/format.go#L249-L285","documentation":"After loading the client key pair, createStorage reads the CA bundle file from the `ca-certs` URL parameter with os.ReadFile. If that read fails (missing file, permission denied) the CA trust pool cannot be built, so the connection is aborted with this error.","triggerScenarios":"Storage URL includes `ca-certs=<path>` (together with ssl-cert/ssl-key) and the CA file cannot be read: nonexistent path, wrong relative path, or unreadable permissions.","commonSituations":"Mount run inside a container without the CA file mounted; path relative to a different working directory than the daemon's; CA bundle regenerated/renamed after the volume was formatted.","solutions":["Check the ca-certs path exists and is readable (ls/os.stat) from the process working directory.","Use an absolute path for ca-certs in the storage URL.","Mount the CA file into the container/pod and fix permissions if running containerized.","Remove the ca-certs param if you intend to use the system CA pool instead."],"exampleFix":"// before\ns3://bucket?ca-certs=ca.pem&ssl-cert=c.pem&ssl-key=k.pem   # ca.pem not in cwd\n// after\ns3://bucket?ca-certs=/etc/juicefs/ca.pem&ssl-cert=/etc/juicefs/c.pem&ssl-key=/etc/juicefs/k.pem","handlingStrategy":"validation","validationCode":"if _, err := os.Stat(caPath); err != nil {\n\treturn fmt.Errorf(\"CA bundle unreadable before mount: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"caCertPEM, err := os.ReadFile(caPath)\nif err != nil {\n\treturn nil, fmt.Errorf(\"error loading CA cert file: %s\", err.Error())\n}","preventionTips":["Reference the CA bundle with an absolute path in the storage URL.","Ensure the CA file is packaged into container images / mounted into pods.","Check file permissions allow the user running juicefs to read it.","Re-check the ca-certs path after CA rotation or certificate renewal."],"tags":["tls","ca-cert","file-read","object-storage"],"backgroundTag":"file-not-found","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}