{"record":{"id":"5fb9e86bf0c5f0c8","repo":"hyperledger/fabric","slug":"unable-to-load-cert-at-s","errorCode":null,"errorMessage":"unable to load cert at '%s'","messagePattern":"unable to load cert at '(.+?)'","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"core/deliverservice/config.go","lineNumber":206,"sourceCode":"\tif c.SecOpts.RequireClientCert {\n\t\tcertFile := config.GetPath(\"peer.tls.clientCert.file\")\n\t\tif certFile == \"\" {\n\t\t\tcertFile = config.GetPath(\"peer.tls.cert.file\")\n\t\t}\n\n\t\tkeyFile := config.GetPath(\"peer.tls.clientKey.file\")\n\t\tif keyFile == \"\" {\n\t\t\tkeyFile = config.GetPath(\"peer.tls.key.file\")\n\t\t}\n\n\t\tkeyPEM, err := os.ReadFile(keyFile)\n\t\tif err != nil {\n\t\t\tpanic(errors.WithMessagef(err, \"unable to load key at '%s'\", keyFile))\n\t\t}\n\t\tc.SecOpts.Key = keyPEM\n\t\tcertPEM, err := os.ReadFile(certFile)\n\t\tif err != nil {\n\t\t\tpanic(errors.WithMessagef(err, \"unable to load cert at '%s'\", certFile))\n\t\t}\n\t\tc.SecOpts.Certificate = certPEM\n\t}\n\n\toverridesMap, err := LoadOverridesMap()\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\n\tc.OrdererEndpointOverrides = overridesMap\n\n\tpolicyKey := \"peer.deliveryclient.policy\"\n\tpolicyMissing := !viper.IsSet(policyKey)\n\tpolicy := DefaultPolicy\n\tif policyMissing {\n\t\tlogger.Infof(\"%s is not set, defaulting to %s.\", policyKey, policy)\n\t} else {\n\t\tpolicy = viper.GetString(policyKey)","sourceCodeStart":188,"sourceCodeEnd":224,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/deliverservice/config.go#L188-L224","documentation":"Same flow as the key load: after successfully reading the key, loadDeliverServiceConfig reads the TLS certificate file and panics with this wrapped error if os.ReadFile fails. It aborts peer startup because the delivery service cannot be configured without its certificate.","triggerScenarios":"TLS enabled but the certificate file path (deliver service cert config or peer.tls.cert.file) is empty, nonexistent, or unreadable when GlobalConfig initializes.","commonSituations":"Cert file not mounted into the container; typo in the cert path in core.yaml; expired/rotated certs removed before peer restart; permissions tightened by secret-management tooling.","solutions":["Verify the cert file path configured for the deliver service / peer.tls.cert.file exists and is readable.","Confirm the TLS certificate volume/secret is mounted correctly in your container orchestration.","Ensure the cert matches the configured key (same pair) and is PEM-encoded.","Use absolute, verified paths and a startup preflight that checks both key and cert before launching the peer."],"exampleFix":"// before\nCORE_PEER_TLS_CERT_FILE=/tls/server.crt   // not mounted in container\n// after\n# in deployment yaml\nvolumeMounts:\n  - name: tls\n    mountPath: /tls\n# with CORE_PEER_TLS_CERT_FILE=/tls/server.crt verified present","handlingStrategy":"validation","validationCode":"certPath := viper.GetString(\"peer.tls.cert.file\")\nif certPath == \"\" {\n    return errors.New(\"peer.tls.cert.file not configured\")\n}\nif fi, err := os.Stat(certPath); err != nil || fi.IsDir() {\n    return fmt.Errorf(\"TLS cert file missing: %s\", certPath)\n}\nblk, _ := pem.Decode(mustRead(certPath))\nif blk == nil || blk.Type != \"CERTIFICATE\" {\n    return errors.New(\"file is not a PEM certificate\")\n}","typeGuard":null,"tryCatchPattern":"// Config loading panics; preflight before starting the peer and, on failure,\n// surface errors.Cause(err) to distinguish missing file vs permission denial.","preventionTips":["Preflight both members of the key/cert pair before startup.","Confirm the cert matches the key (compare public keys/Modulus).","Mount TLS secrets read-only and verify paths in deployment manifests.","Re-provision certs (e.g. after rotation) before restarting peers."],"tags":["tls","config","startup","panic"],"backgroundTag":"tls-cert-file-not-found","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}