{"record":{"id":"6339bcd27f3bbc96","repo":"t8y2/dbx","slug":"failed-to-parse-ca-certificate-at-s-6339bc","errorCode":null,"errorMessage":"failed to parse CA certificate at %s","messagePattern":"failed to parse CA certificate at (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/etcd2-go/client.go","lineNumber":185,"sourceCode":"\tif seconds < 1 {\n\t\tseconds = 1\n\t}\n\tif seconds > 300 {\n\t\tseconds = 300\n\t}\n\treturn time.Duration(seconds) * time.Second\n}\n\nfunc tlsConfigFor(connection connectionParams) (*tls.Config, error) {\n\ttlsConfig := &tls.Config{}\n\tif ca := strings.TrimSpace(connection.CACertPath); ca != \"\" {\n\t\tauthorityPEM, err := os.ReadFile(ca)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tpool := x509.NewCertPool()\n\t\tif !pool.AppendCertsFromPEM(authorityPEM) {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse CA certificate at %s\", ca)\n\t\t}\n\t\ttlsConfig.RootCAs = pool\n\t}\n\tcertPath := firstNonBlank(connection.ClientCertPath, connection.CertPath)\n\tkeyPath := firstNonBlank(connection.ClientKeyPath, connection.KeyPath)\n\tif (certPath == \"\") != (keyPath == \"\") {\n\t\treturn nil, errors.New(\"Client certificate and key must be provided together\")\n\t}\n\tif certPath != \"\" {\n\t\tpair, err := tls.LoadX509KeyPair(certPath, keyPath)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\ttlsConfig.Certificates = []tls.Certificate{pair}\n\t}\n\treturn tlsConfig, nil\n}\n","sourceCodeStart":167,"sourceCodeEnd":203,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/etcd2-go/client.go#L167-L203","documentation":"tlsConfigFor reads the configured CA certificate PEM file and appends it to an x509 CertPool; AppendCertsFromPEM returns false when the file contains no parseable certificates, and the agent converts that into this error naming the file path. The TLS connection is aborted before any request is sent.","triggerScenarios":"Configuring a connection whose CA path points to a file that does not contain any valid PEM certificate blocks (wrong file, empty file, DER-encoded cert, concatenated junk).","commonSituations":"Pointing cacert at a private key or CSR instead of a certificate; a DER (.crt binary) cert that Go cannot parse as PEM; an empty or truncated file from a failed secret mount; copying the wrong file in Kubernetes secret volumes.","solutions":["Verify the file at the path is a PEM-encoded certificate (begins with '-----BEGIN CERTIFICATE-----')","Regenerate or re-export the CA cert in PEM format (e.g. openssl x509 -in ca.der -out ca.pem -outform PEM)","Check the path/config — ensure cacert points to the CA, not the client cert/key, and that the secret mounted correctly"],"exampleFix":"// before\nconfig := map[string]any{\"endpoints\": [\"https://e:2379\"], \"cacert\": \"/etc/pki/ca.der\"}\n\n// after\n// convert to PEM first: openssl x509 -inform DER -in ca.der -out ca.pem\nconfig := map[string]any{\"endpoints\": [\"https://e:2379\"], \"cacert\": \"/etc/pki/ca.pem\"}","handlingStrategy":"validation","validationCode":"func validateCAPEM(path string) error {\n    pem, err := os.ReadFile(path)\n    if err != nil { return err }\n    if !strings.Contains(string(pem), \"-----BEGIN CERTIFICATE-----\") {\n        return fmt.Errorf(\"%s is not a PEM certificate\", path)\n    }\n    pool := x509.NewCertPool()\n    if !pool.AppendCertsFromPEM(pem) { return fmt.Errorf(\"%s has no parseable certs\", path) }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"cfg, err := buildTLSConfig(caPath, certPath, keyPath)\nif err != nil && strings.Contains(err.Error(), \"failed to parse CA certificate\") {\n    return fmt.Errorf(\"check cacert %s: must be PEM x509 cert, got invalid file\", caPath)\n}","preventionTips":["Verify PEM headers in CA files before wiring them into config","Never point cacert at a key, CSR, or DER-encoded cert","In Kubernetes, confirm the secret mounts real certs (check mounted file contents)"],"tags":["go","tls","certificates","configuration"],"backgroundTag":"invalid-ca-certificate","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}