{"record":{"id":"6c96ebd55ac72809","repo":"risingwavelabs/risingwave","slug":"failed-to-add-native-ca-certificate","errorCode":null,"errorMessage":"Failed to add native CA certificate","messagePattern":"Failed to add native CA certificate","errorType":"exception","errorClass":"PsqlError","httpStatus":null,"severity":"warning","filePath":"src/utils/pgwire/src/ldap_auth.rs","lineNumber":119,"sourceCode":"                let cert = cert.map_err(|e| {\n                    PsqlError::StartupError(\n                        anyhow!(e).context(\"Failed to parse CA certificate\").into(),\n                    )\n                })?;\n                root_cert_store.add(cert).map_err(|err| {\n                    PsqlError::StartupError(\n                        anyhow!(err).context(\"Failed to add CA certificate\").into(),\n                    )\n                })?;\n            }\n        } else {\n            // If ca certs is not present, load system native certs.\n            for cert in\n                rustls_native_certs::load_native_certs().expect(\"could not load platform certs\")\n            {\n                root_cert_store.add(cert).map_err(|err| {\n                    PsqlError::StartupError(\n                        anyhow!(err)\n                            .context(\"Failed to add native CA certificate\")\n                            .into(),\n                    )\n                })?;\n            }\n        }\n        let tls_client_config = tls_client_config.with_root_certificates(root_cert_store);\n\n        if let Some(cert) = &self.cert {\n            let Some(key) = &self.key else {\n                return Err(PsqlError::StartupError(\n                    \"Client certificate provided without private key\".into(),\n                ));\n            };\n            let client_cert_bytes = fs::read(cert).map_err(|e| {\n                PsqlError::StartupError(\n                    anyhow!(e)\n                        .context(\"Failed to read client certificate\")","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/utils/pgwire/src/ldap_auth.rs#L101-L137","documentation":"When no custom ca_cert is configured, pgwire loads the platform's native root certificates via `rustls_native_certs::load_native_certs()` and adds them to the root store; adding one of these native certs failed. Note the loader itself uses `.expect(\"could not load platform certs\")`, so this error specifically covers per-certificate insertion failures.","triggerScenarios":"`init_client_config` with no `ca_cert` set: `root_cert_store.add(cert)` fails for one of the certs returned by `load_native_certs()` — typically a system certificate store entry that rustls cannot accept as a trust anchor.","commonSituations":"Minimal container images with odd/partial system CA bundles; distro cert stores containing legacy or malformed certificates; unusual OS certificate locations.","solutions":["Identify the offending system certificate and remove/update it from the OS trust store.","Update the ca-certificates package / base image so the system bundle is valid.","Bypass native certs by explicitly configuring a known-good ca_cert file.","Read the inner rustls error from the context to see which native cert was rejected."],"exampleFix":"// before: relying on minimal image's cert store\n// (no ca_cert set)\n// after: explicit CA bundle\nca_cert = \"/etc/ssl/certs/ca-certificates.crt\"","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"match err {\n    PsqlError::StartupError(e) if e.to_string().contains(\"Failed to add native CA certificate\") => {\n        eprintln!(\"bad system cert store; configure explicit ca_cert: {}\", e);\n    }\n    other => return Err(other),\n}","preventionTips":["Use maintained base images with up-to-date ca-certificates.","Prefer explicitly configuring a known-good CA bundle over native store loading.","Refresh system cert stores when building images."],"tags":["ldap","tls","certificate","rustls","platform"],"backgroundTag":"invalid-argument-value","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}