{"record":{"id":"56ba5336ca9631a9","repo":"nats-io/nats-server","slug":"failed-to-parse-ca-file-v","errorCode":null,"errorMessage":"failed to parse ca_file: %v","messagePattern":"failed to parse ca_file: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/ocsp.go","lineNumber":949,"sourceCode":"\t}\n\n\treturn certstore.GetLeafIssuer(leaf, vOpts), nil\n}\n\n// getOCSPIssuer determines an issuer certificate from the cert (bundle) or the file-based CA trust store\nfunc getOCSPIssuer(caFile string, chain [][]byte) (*x509.Certificate, error) {\n\tvar issuer *x509.Certificate\n\tvar trustedCAs []*x509.Certificate\n\tvar certBundle []*x509.Certificate\n\tvar err error\n\n\t// FIXME(tgb): extend if pluggable CA store provider added to NATS (i.e. other than PEM file)\n\n\t// Non-system default CA trust store passed\n\tif caFile != _EMPTY_ {\n\t\ttrustedCAs, err = parseCertPEM(caFile)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse ca_file: %v\", err)\n\t\t}\n\t}\n\n\t// Specify bundled intermediate CA store\n\tfor _, certBytes := range chain {\n\t\tcert, err := x509.ParseCertificate(certBytes)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse cert: %v\", err)\n\t\t}\n\t\tcertBundle = append(certBundle, cert)\n\t}\n\n\tissuer, err = getOCSPIssuerLocally(trustedCAs, certBundle)\n\tif err != nil || issuer == nil {\n\t\treturn nil, fmt.Errorf(\"no issuers found\")\n\t}\n\n\tif !issuer.IsCA {","sourceCodeStart":931,"sourceCodeEnd":967,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/ocsp.go#L931-L967","documentation":"The OCSP monitor's trusted CA pool is built by parseCertPEM on the configured ca_file. If the PEM file cannot be parsed into x509 certificates (bad format, non-cert PEM blocks, unreadable/corrupt content), the error is wrapped as \"failed to parse ca_file\".","triggerScenarios":"NewOCSPMonitor invoked with a non-empty ca_file where parseCertPEM(caFile) returns any error (empty PEM, invalid base64, unexpected block types, zero certificates).","commonSituations":"ca_file path typo leading to empty/garbage file, file containing DER (binary) instead of PEM, file with only a private key, or truncated file after transfer.","solutions":["Validate the file with `openssl x509 -in ca.pem -text -noout` before configuring it","Convert DER to PEM if needed: `openssl x509 -inform der -in ca.der -out ca.pem`","Check file permissions/readability for the NATS process user"],"exampleFix":"// before\nocsp: { ca_file: /etc/nats/ca.der }  // DER binary\n// after\nopenssl x509 -inform der -in ca.der -out ca.pem\n# nats.conf\nocsp: { ca_file: /etc/nats/ca.pem }","handlingStrategy":"validation","validationCode":"data, err := os.ReadFile(caFile)\nif err != nil { return err }\nif _, err := x509.ParseCertificates(pemBytesOf(data)); err != nil { return fmt.Errorf(\"ca_file invalid: %w\", err) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Convert DER to PEM before configuring ca_file","Check file readability under the service account","Lint configs in CI by parsing the CA file at startup of a test server"],"tags":["tls","pem","ocsp","configuration"],"backgroundTag":"invalid-ca-certificate-file","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}