{"record":{"id":"5d32d127e3b667bf","repo":"VictoriaMetrics/VictoriaMetrics","slug":"cannot-parse-tls-config-for-oauth2-w","errorCode":null,"errorMessage":"cannot parse TLS config for OAuth2: %w","messagePattern":"cannot parse TLS config for OAuth2: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/promauth/config.go","lineNumber":216,"sourceCode":"\t\t\tClientID:       o.ClientID,\n\t\t\tClientSecret:   o.ClientSecret.String(),\n\t\t\tTokenURL:       o.TokenURL,\n\t\t\tScopes:         o.Scopes,\n\t\t\tEndpointParams: urlValuesFromMap(o.EndpointParams),\n\t\t},\n\t}\n\tif o.ClientSecretFile != \"\" {\n\t\toi.clientSecretFile = fscore.GetFilepath(baseDir, o.ClientSecretFile)\n\t\t// There is no need in reading oi.clientSecretFile now, since it may be missing right now.\n\t\t// It is read later before performing oauth2 request to server.\n\t}\n\topts := &Options{\n\t\tBaseDir:   baseDir,\n\t\tTLSConfig: o.TLSConfig,\n\t}\n\tac, err := opts.NewConfig()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot parse TLS config for OAuth2: %w\", err)\n\t}\n\toi.ac = ac\n\tif o.ProxyURL != \"\" {\n\t\tu, err := url.Parse(o.ProxyURL)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"cannot parse proxy_url=%q: %w\", o.ProxyURL, err)\n\t\t}\n\t\toi.proxyURL = o.ProxyURL\n\t\toi.proxyURLFunc = http.ProxyURL(u)\n\t}\n\ttokenURLHeaders, err := parseHeaders(o.Headers)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"cannot parse headers for token_url: %w\", err)\n\t}\n\toi.tokenURLHeaders = tokenURLHeaders\n\treturn oi, nil\n}\n","sourceCodeStart":198,"sourceCodeEnd":234,"githubUrl":"https://github.com/VictoriaMetrics/VictoriaMetrics/blob/5079fb58f1e8e62113f90c945ad71586c797d770/lib/promauth/config.go#L198-L234","documentation":"newOAuth2ConfigInternal builds an auth Config from the OAuth2Config's embedded TLS settings by creating Options and calling NewConfig. This error wraps any failure of that TLS config parsing/validation, so the OAuth2 client cannot be initialized with the requested TLS parameters.","triggerScenarios":"initFromOAuth2Config -> newOAuth2ConfigInternal where opts.NewConfig() fails — e.g. tls_ca/tls_cert/tls_key files referenced by the embedded TLSConfig cannot be read or parsed, or TLS options are invalid.","commonSituations":"CA/cert/key file paths wrong or files missing inside the container; PEM files with invalid content (wrong format, expired cert not yet relevant at parse time); mount not present at startup; permissions deny reading the cert files.","solutions":["Verify all TLS file paths (ca, cert, key) in the oauth2 block exist and are readable by the process","Validate the PEM content (openssl x509 -in ca.crt -text) to ensure files are valid certificates/keys","Check container/volume mounts are present before the app starts","Inspect the wrapped %w error from NewConfig to pinpoint which option failed"],"exampleFix":"// before\noauth2:\n  tls_ca: /etc/certs/ca.pem   # file missing\n// after: mount or fix the path\noauth2:\n  tls_ca: /etc/ssl/certs/ca.pem","handlingStrategy":"validation","validationCode":"for _, p := range []string{oauthCfg.TLSConfig.CA, oauthCfg.TLSConfig.Cert, oauthCfg.TLSConfig.Key} {\n    if p != \"\" {\n        if _, err := os.ReadFile(p); err != nil {\n            return fmt.Errorf(\"TLS file %q unreadable before OAuth2 init: %w\", p, err)\n        }\n    }\n}","typeGuard":"func tlsFilesReadable(c promauth.TLSConfig) bool {\n    for _, p := range []string{c.CA, c.Cert, c.Key} {\n        if p != \"\" {\n            if _, err := os.ReadFile(p); err != nil {\n                return false\n            }\n        }\n    }\n    return true\n}","tryCatchPattern":"if err := ac.InitFromOAuth2Config(oauthCfg); err != nil {\n    if strings.Contains(err.Error(), \"cannot parse TLS config for OAuth2\") {\n        return fmt.Errorf(\"check TLS cert/key/CA paths and PEM validity for oauth2: %w\", err)\n    }\n    return err\n}","preventionTips":["Mount cert/CA files as read-only volumes and verify mount order at startup","Validate PEM files with openssl before deployment","Use absolute paths for TLS files; avoid relative paths that depend on working directory","Check file permissions so the service user can read the cert files"],"tags":["oauth2","tls","configuration"],"backgroundTag":"tls-config-invalid","analyzedSha":"5079fb58f1e8e62113f90c945ad71586c797d770","analyzedAt":"2026-09-03T18:10:26.153Z","contentChangedAt":"2026-09-03T18:10:26.153Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}