{"record":{"id":"57479940e3e5a69c","repo":"cloudflare/cloudflared","slug":"error-loading-cert-pool","errorCode":null,"errorMessage":"Error loading cert pool","messagePattern":"Error loading cert pool","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ingress/origin_service.go","lineNumber":349,"sourceCode":"\t\tService:  newManagementService(management),\n\t}\n}\n\ntype NopReadCloser struct{}\n\n// Read always returns EOF to signal end of input\nfunc (nrc *NopReadCloser) Read(buf []byte) (int, error) {\n\treturn 0, io.EOF\n}\n\nfunc (nrc *NopReadCloser) Close() error {\n\treturn nil\n}\n\nfunc newHTTPTransport(service OriginService, cfg OriginRequestConfig, log *zerolog.Logger) (*http.Transport, error) {\n\toriginCertPool, err := tlsconfig.LoadOriginCA(cfg.CAPool, log)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"Error loading cert pool\")\n\t}\n\n\thttpTransport := http.Transport{\n\t\tProxy:                 http.ProxyFromEnvironment,\n\t\tMaxIdleConns:          cfg.KeepAliveConnections,\n\t\tMaxIdleConnsPerHost:   cfg.KeepAliveConnections,\n\t\tIdleConnTimeout:       cfg.KeepAliveTimeout.Duration,\n\t\tTLSHandshakeTimeout:   cfg.TLSTimeout.Duration,\n\t\tExpectContinueTimeout: 1 * time.Second,\n\t\tTLSClientConfig:       &tls.Config{RootCAs: originCertPool, InsecureSkipVerify: cfg.NoTLSVerify},\n\t\tForceAttemptHTTP2:     cfg.Http2Origin,\n\t}\n\tif _, isHelloWorld := service.(*helloWorld); !isHelloWorld && cfg.OriginServerName != \"\" {\n\t\thttpTransport.TLSClientConfig.ServerName = cfg.OriginServerName\n\t}\n\n\tdialer := &net.Dialer{\n\t\tTimeout:   cfg.ConnectTimeout.Duration,","sourceCodeStart":331,"sourceCodeEnd":367,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ingress/origin_service.go#L331-L367","documentation":"newHTTPTransport builds the http.Transport used to reach HTTP(S) origins and first loads the origin CA pool with tlsconfig.LoadOriginCA (from cfg.CAPool). If the CA pool cannot be read or parsed, the error is wrapped with this message and the origin transport cannot be constructed, so the service fails to start.","triggerScenarios":"An origin request config with originServerName/CA pool set where cfg.CAPool points to a missing, unreadable, or malformed certificate file, causing tlsconfig.LoadOriginCA to fail.","commonSituations":"Wrong path to origin-ca-pool in config.yml, certificate file with wrong permissions, PEM file that is empty or corrupted, or forgetting to provision the CA file in a container image.","solutions":["Check the wrapped inner error to see whether the CA file was not found or failed to parse.","Verify the CA pool path in your config exists and is readable by the cloudflared process.","Ensure the file contains valid PEM-encoded certificates (e.g. Cloudflare origin ca root or your own CA).","If your origin uses a publicly trusted cert, remove the custom CA pool setting so the system pool is used."],"exampleFix":"// before (config.yml)\noriginRequest:\n  caPool: /etc/cloudflared/origin-ca.pem   # file does not exist\n// after\noriginRequest:\n  caPool: /etc/cloudflared/certs/origin-ca.pem  # verify path & permissions","handlingStrategy":"validation","validationCode":"func ensureCAPoolReadable(path string) error {\n    if path == \"\" {\n        return nil // system pool will be used\n    }\n    f, err := os.Open(path)\n    if err != nil {\n        return fmt.Errorf(\"caPool unreadable: %w\", err)\n    }\n    defer f.Close()\n    data, err := io.ReadAll(f)\n    if err != nil {\n        return err\n    }\n    if !bytes.Contains(data, []byte(\"BEGIN CERTIFICATE\")) {\n        return fmt.Errorf(\"caPool %s contains no PEM certificates\", path)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if err := ensureCAPoolReadable(cfg.CAPool); err != nil {\n    return fmt.Errorf(\"aborting: %w\", err)\n}\n// then proceed with StartOrigins","preventionTips":["Mount and verify the CA pool file exists in container images before startup.","Keep PEM files readable by the cloudflared user (check file permissions).","Omit caPool when your origin uses publicly trusted certificates."],"tags":["tls","certificate","ca-pool","origin"],"backgroundTag":"file-not-found","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}