{"record":{"id":"5e21801cd9bd762e","repo":"siyuan-note/siyuan","slug":"failed-to-load-ca-certificates-w","errorCode":null,"errorMessage":"failed to load CA certificates: %w","messagePattern":"failed to load CA certificates: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"kernel/util/tls_cert_manager.go","lineNumber":153,"sourceCode":"\n\tcurrentState := manager.state.Load()\n\tif currentState == nil {\n\t\treturn nil, fmt.Errorf(\"TLS certificate is not initialized\")\n\t}\n\tnow := time.Now()\n\tif tlsCertificateStateValid(currentState, now) &&\n\t\t(localIP == nil || certificateContainsIP(currentState.leaf, localIP)) {\n\t\treturn &currentState.certificate, nil\n\t}\n\n\tprivateKey, ok := currentState.certificate.PrivateKey.(crypto.Signer)\n\tif !ok {\n\t\treturn nil, fmt.Errorf(\"TLS server private key does not implement crypto.Signer\")\n\t}\n\n\tcaCert, caKey, err := loadCA(manager.caCertPath, manager.caKeyPath)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to load CA certificates: %w\", err)\n\t}\n\n\tipAddresses := collectServerCertificateIPs(currentState.leaf.IPAddresses, localIP)\n\tdnsNames := collectServerCertificateDNSNames(currentState.leaf.DNSNames)\n\tcertDER, leaf, err := createServerCertificate(caCert, caKey, privateKey, ipAddresses, dnsNames)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to generate TLS server certificate: %w\", err)\n\t}\n\n\tcertificate := tls.Certificate{\n\t\tCertificate: [][]byte{certDER},\n\t\tPrivateKey:  privateKey,\n\t\tLeaf:        leaf,\n\t}\n\tnewState := &tlsCertificateState{certificate: certificate, leaf: leaf}\n\tmanager.state.Store(newState)\n\n\tcertPEM := pem.EncodeToMemory(&pem.Block{Type: \"CERTIFICATE\", Bytes: certDER})","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/8641553a1f07374001902d3ce773285db1292b2d/kernel/util/tls_cert_manager.go#L135-L171","documentation":"The TLS certificate manager lazily (re)issues the server leaf certificate inside refreshCertificate, first loading the local CA (caCertPath/caKeyPath) via loadCA. If reading or parsing the CA cert/key files fails for any reason, the error is wrapped with this message and GetCertificate fails, aborting the TLS handshake.","triggerScenarios":"GetCertificate triggers refreshCertificate (certificate expired, not yet valid, or new local IP not covered) and loadCA fails — CA files missing/corrupted/unreadable, wrong PEM contents, encrypted or mismatched key, or filesystem permission errors.","commonSituations":"Workspace data directory restored from backup without the CA files, disk/permission problems, CA key regenerated independently of the cert, or first-run CA generation silently failed earlier.","solutions":["Check the wrapped %w cause in the log: if files are missing/corrupt, remove the stale CA files (caCertPath/caKeyPath) so a fresh CA is generated on next start","Fix filesystem permissions on the workspace temp/conf directory holding the CA files","Verify the CA key matches the CA certificate and both are valid unencrypted PEM","If the failure persists, reinitialize the TLS cert manager state (restart kernel) to regenerate the CA"],"exampleFix":"// before: corrupted ca.key on disk -> failed to load CA certificates: ...\n// after: delete stale CA pair so it is regenerated\nos.Remove(manager.caCertPath)\nos.Remove(manager.caKeyPath)\ncert, err := manager.GetCertificate(hello) // regenerates CA + leaf","handlingStrategy":"try-catch","validationCode":"// before handshake: verify CA files exist and parse\nif _, err := os.Stat(manager.caCertPath); err != nil {\n\t// CA missing: regenerate or restore workspace files first\n}\nif _, err := tls.LoadX509KeyPair(manager.caCertPath, manager.caKeyPath); err != nil {\n\t// CA pair unreadable/mismatched: recreate CA before serving TLS\n}","typeGuard":null,"tryCatchPattern":"cert, err := certManager.GetCertificate(hello)\nif err != nil {\n\tlogging.LogErrorf(\"TLS handshake cert unavailable: %s\", err)\n\t// treat connection as failed; do not serve with a nil certificate\n\treturn nil, err\n}","preventionTips":["Back up and restore the CA files together with the workspace","Keep CA cert/key files on a writable volume with correct permissions","Monitor loadCA failures at startup; regenerate a fresh CA when files are corrupt","Never regenerate one of the CA pair independently of the other"],"tags":["tls","certificate","ca","file"],"backgroundTag":"file-read-failed","analyzedSha":"8641553a1f07374001902d3ce773285db1292b2d","analyzedAt":"2026-09-11T16:08:28.414Z","contentChangedAt":"2026-09-11T16:08:28.414Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}