{"record":{"id":"505b5b2f1d5288a5","repo":"docker/cli","slug":"failed-to-retrieve-context-tls-info-w","errorCode":null,"errorMessage":"failed to retrieve context tls info: %w","messagePattern":"failed to retrieve context tls info: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/context/docker/load.go","lineNumber":72,"sourceCode":"\t\t\treturn nil, errors.New(\"failed to retrieve context tls info: ca.pem seems invalid\")\n\t\t}\n\t\ttlsOpts = append(tlsOpts, func(cfg *tls.Config) {\n\t\t\tcfg.RootCAs = certPool\n\t\t})\n\t}\n\tif ep.TLSData != nil && ep.TLSData.Key != nil && ep.TLSData.Cert != nil {\n\t\tkeyBytes := ep.TLSData.Key\n\t\tpemBlock, _ := pem.Decode(keyBytes)\n\t\tif pemBlock == nil {\n\t\t\treturn nil, errors.New(\"no valid private key found\")\n\t\t}\n\t\tif x509.IsEncryptedPEMBlock(pemBlock) { //nolint:staticcheck // SA1019: x509.IsEncryptedPEMBlock is deprecated, and insecure by design\n\t\t\treturn nil, errors.New(\"private key is encrypted - support for encrypted private keys has been removed, see https://docs.docker.com/go/deprecated/\")\n\t\t}\n\n\t\tx509cert, err := tls.X509KeyPair(ep.TLSData.Cert, keyBytes)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to retrieve context tls info: %w\", err)\n\t\t}\n\t\ttlsOpts = append(tlsOpts, func(cfg *tls.Config) {\n\t\t\tcfg.Certificates = []tls.Certificate{x509cert}\n\t\t})\n\t}\n\tif ep.SkipTLSVerify {\n\t\ttlsOpts = append(tlsOpts, func(cfg *tls.Config) {\n\t\t\tcfg.InsecureSkipVerify = true\n\t\t})\n\t}\n\treturn tlsconfig.ClientDefault(tlsOpts...), nil\n}\n\n// ClientOpts returns a slice of Client options to configure an API client with this endpoint\nfunc (ep *Endpoint) ClientOpts() ([]client.Opt, error) {\n\tvar result []client.Opt\n\tif ep.Host != \"\" {\n\t\thelper, err := connhelper.GetConnectionHelper(ep.Host)","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/context/docker/load.go#L54-L90","documentation":"Returned by docker.Endpoint.tlsConfig() (reached via Endpoint.ClientOpts()) when tls.X509KeyPair(cert, key) fails to build a TLS certificate from the context's stored PEM material. The wrapped error is Go stdlib crypto/tls, indicating malformed PEM, a truncated blob, or a key/cert that do not correspond.","triggerScenarios":"Calling endpoint.ClientOpts() for a context whose TLS material has a cert/key pair failing X509KeyPair: key and cert mismatched, cert not actually a certificate, key not in PEM format, or files truncated/corrupted. Only reached when ep.Host is a non-socket host and ep.TLSData has both Key and Cert set.","commonSituations":"Cert rotation that updated only cert or only key; pointing a context at the wrong key file; manually editing TLS files and truncating PEM headers; DER instead of PEM; copy-paste leaving stray whitespace.","solutions":["Re-import a matching cert+key pair into the context (docker context import / context update with correct TLS material).","Verify the pair offline: `openssl x509 -in cert.pem -noout`, `openssl rsa -in key.pem -check`, and compare modulus (`openssl x509 -modulus`, `openssl rsa -modulus`).","Recreate the context's TLS material from known-good files."],"exampleFix":"// before\nopts, err := endpoint.ClientOpts() // -> \"failed to retrieve context tls info\"\n\n// after: validate the pair before relying on the endpoint\nif _, err := tls.X509KeyPair(certPEM, keyPEM); err != nil {\n    return fmt.Errorf(\"reload cert/key before use: %w\", err)\n}\nopts, err := endpoint.ClientOpts()","handlingStrategy":"validation","validationCode":"// Validate the cert/key pair before constructing client opts.\nif ep.TLSData != nil && ep.TLSData.Key != nil && ep.TLSData.Cert != nil {\n    if _, err := tls.X509KeyPair(ep.TLSData.Cert, ep.TLSData.Key); err != nil {\n        return fmt.Errorf(\"context TLS material is unusable: %w\", err)\n    }\n}\nopts, err := ep.ClientOpts()","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always update cert and key together when rotating credentials.","Verify a pair with openssl (modulus match) before importing into a context.","Keep PEM material in PEM (not DER) and avoid editing it by hand."],"tags":["tls","certificates","context","docker-engine","pem"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}