{"record":{"id":"5bb023c8416347ca","repo":"hashicorp/terraform","slug":"failed-to-append-custom-cert-to-the-pool","errorCode":null,"errorMessage":"failed to append custom cert to the pool","messagePattern":"failed to append custom cert to the pool","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oci/auth.go","lineNumber":437,"sourceCode":"\n\tif domainNameOverride != \"\" {\n\t\thasCorrectDomainName := getEnvSettingWithBlankDefault(HasCorrectDomainNameEnv)\n\t\tre := regexp.MustCompile(`(.*?)[-\\w]+\\.\\w+$`) // (capture: preamble) match: d0main-name . tld end-of-string\n\t\tif hasCorrectDomainName == \"\" || !strings.HasSuffix(client.Host, hasCorrectDomainName) {\n\t\t\tclient.Host = re.ReplaceAllString(client.Host, \"${1}\"+domainNameOverride) // non-match conveniently returns original string\n\t\t}\n\t}\n\n\tcustomCertLoc := getEnvSettingWithBlankDefault(CustomCertLocationEnv)\n\n\tif customCertLoc != \"\" {\n\t\tcert, err := os.ReadFile(customCertLoc)\n\t\tif err != nil {\n\t\t\treturn &client, err\n\t\t}\n\t\tpool := x509.NewCertPool()\n\t\tif ok := pool.AppendCertsFromPEM(cert); !ok {\n\t\t\treturn nil, fmt.Errorf(\"failed to append custom cert to the pool\")\n\t\t}\n\t\t// install the certificates in the client\n\t\thttpClient.Transport.(*http.Transport).TLSClientConfig.RootCAs = pool\n\t}\n\n\tif acceptLocalCerts := getEnvSettingWithBlankDefault(AcceptLocalCerts); acceptLocalCerts != \"\" {\n\t\tif boolVal, err := strconv.ParseBool(acceptLocalCerts); err == nil {\n\t\t\thttpClient.Transport.(*http.Transport).TLSClientConfig.InsecureSkipVerify = boolVal\n\t\t}\n\t}\n\n\treturn &client, nil\n}\nfunc getClientHostOverride() string {\n\t// Get the host URL override for clients\n\n\tclientHostOverridesString := getEnvSettingWithBlankDefault(ClientHostOverridesEnv)\n\tif clientHostOverridesString == \"\" {","sourceCodeStart":419,"sourceCodeEnd":455,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/backend/remote-state/oci/auth.go#L419-L455","documentation":"Returned by buildHttpClient() (or the client construction function containing this logic) when AppendCertsFromPEM fails to add the custom certificate from the file pointed to by the OCI custom cert environment variable. AppendCertsFromPEM returns false (and thus !ok is true) when the PEM data is empty or not valid PEM-encoded certificate data.","triggerScenarios":"The environment variable for custom certificate location (CustomCertLocationEnv, e.g., OCI_SDK_CUSTOM_CERT) is set to a file that either contains non-PEM data, is empty, or contains malformed/corrupt PEM. The code reads the file successfully but pool.AppendCertsFromPEM returns false.","commonSituations":"User pointed the custom cert env var at a DER-encoded (binary) certificate instead of PEM; the cert file is empty or a placeholder; the PEM is truncated or corrupted; user pointed at the wrong file (e.g., a private key file instead of a certificate); expired or otherwise unparseable certificate content.","solutions":["Ensure the custom cert file is PEM-encoded (starts with '-----BEGIN CERTIFICATE-----').","If you have a DER cert, convert it: openssl x509 -inform DER -in cert.der -outform PEM -out cert.pem.","Verify the PEM file is valid: openssl x509 -in cert.pem -text -noout.","Remove the custom cert environment variable if a custom CA is not needed.","Check the file is not empty or corrupted: cat the file and look for proper PEM headers/footers."],"exampleFix":"// before\nexport OCI_SDK_CUSTOM_CERT=/path/to/cert.der  # binary DER, not PEM\nterraform init\n\n// after\nopenssl x509 -inform DER -in /path/to/cert.der -outform PEM -out /path/to/cert.pem\nexport OCI_SDK_CUSTOM_CERT=/path/to/cert.pem\nterraform init","handlingStrategy":"validation","validationCode":"func validateCustomCertPEM(certPath string) error {\n    data, err := os.ReadFile(certPath)\n    if err != nil {\n        return fmt.Errorf(\"cannot read custom cert: %w\", err)\n    }\n    pool := x509.NewCertPool()\n    if !pool.AppendCertsFromPEM(data) {\n        // Check if it's DER\n        if _, err := x509.ParseCertificate(data); err == nil {\n            return fmt.Errorf(\"custom cert at %s is DER-encoded, not PEM — convert with: openssl x509 -inform DER -outform PEM\", certPath)\n        }\n        return fmt.Errorf(\"custom cert at %s is not valid PEM\", certPath)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Validate custom cert before terraform init:\ncertPath := os.Getenv(\"OCI_SDK_CUSTOM_CERT\") // or the actual env var name\nif certPath != \"\" {\n    if err := validateCustomCertPEM(certPath); err != nil {\n        log.Fatal(err)\n    }\n}","preventionTips":["Always use PEM-encoded certificates for the custom cert environment variable.","Validate the cert file with openssl before pointing the env var at it.","Remove the custom cert env var if a custom CA root is not needed in your environment."],"tags":["oci","authentication","tls","certificates","pem","ca-pool","terraform-backend"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}