{"record":{"id":"756e98c88d8fdbfd","repo":"juicedata/juicefs","slug":"read-ca-cert-file-error-path-s-error-s","errorCode":null,"errorMessage":"read ca cert file error path:%s error:%s","messagePattern":"read ca cert file error path:(.+?) error:(.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/meta/redis.go","lineNumber":156,"sourceCode":"\thosts := u.Host\n\topt, err := redis.ParseURL(u.String())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"redis parse %s: %s\", uri, err)\n\t}\n\tif opt.TLSConfig != nil {\n\t\topt.TLSConfig.ServerName = tlsServerName // use the host of each connection as ServerName\n\t\topt.TLSConfig.InsecureSkipVerify = skipVerify != \"\"\n\t\tif certFile != \"\" {\n\t\t\tcert, err := tls.LoadX509KeyPair(certFile, keyFile)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"get certificate error certFile:%s keyFile:%s error:%s\", certFile, keyFile, err)\n\t\t\t}\n\t\t\topt.TLSConfig.Certificates = []tls.Certificate{cert}\n\t\t}\n\t\tif caCertFile != \"\" {\n\t\t\tcaCert, err := os.ReadFile(caCertFile)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"read ca cert file error path:%s error:%s\", caCertFile, err)\n\t\t\t}\n\t\t\tcaCertPool := x509.NewCertPool()\n\t\t\tcaCertPool.AppendCertsFromPEM(caCert)\n\t\t\topt.TLSConfig.RootCAs = caCertPool\n\t\t}\n\t}\n\tif opt.Password == \"\" {\n\t\topt.Password = os.Getenv(\"REDIS_PASSWORD\")\n\t}\n\tif opt.Password == \"\" {\n\t\topt.Password = os.Getenv(\"META_PASSWORD\")\n\t}\n\tif opt.Password == \"\" {\n\t\tif passwordFile := os.Getenv(\"META_PASSWORD_FILE\"); passwordFile != \"\" {\n\t\t\tpassword, err := readPasswordFromFile(passwordFile)\n\t\t\tif err != nil {\n\t\t\t\tlogger.Errorf(\"%v\", err)\n\t\t\t} else {","sourceCodeStart":138,"sourceCodeEnd":174,"githubUrl":"https://github.com/juicedata/juicefs/blob/c9a67b23e8e08ec23ec331aa6f1675e2319e921c/pkg/meta/redis.go#L138-L174","documentation":"newRedisMeta returns this when the CA certificate file given via the tls-ca-cert-file URL parameter cannot be read from disk (pkg/meta/redis.go:156). It wraps the underlying os.ReadFile error (path plus Go error), so the cause is almost always a wrong path, missing file, or permission problem. It is only raised when TLS is enabled and a CA file was explicitly configured.","triggerScenarios":"Mounting a JuiceFS volume with a redis://...?tls-ca-cert-file=/path/to/ca.pem metadata URL where the file does not exist, is unreadable (permissions), is a directory, or the path is malformed. Happens at client startup in newRedisMeta before any Redis connection is made.","commonSituations":"Typo in the CA path in the mount command or systemd unit; CA file deleted or rotated by cert management (cert-manager, k8s secrets remount); running the mount in a container where the host path was not volume-mounted; running as a non-root user who cannot read the cert directory.","solutions":["Verify the path in tls-ca-cert-file exists and is readable: ls -l <path> and fix the typo or path.","If running in a container/K8s, ensure the CA file is mounted into the pod at the referenced path.","Check file permissions (chmod/chown) so the user running juicefs can read it.","If the Redis server uses a CA already in the system trust store, drop the tls-ca-cert-file parameter entirely."],"exampleFix":"// before\njuicefs mount \"redis://rediss-host:6379/1?tls-ca-cert-file=/etc/juicefs/ca.crt\" /mnt/jfs\n// error: read ca cert file error path:/etc/juicefs/ca.crt error:open ...: no such file or directory\n// after: fix the path (or install the file)\njuicefs mount \"redis://rediss-host:6379/1?tls-ca-cert-file=/etc/ssl/juicefs/ca.pem\" /mnt/jfs","handlingStrategy":"validation","validationCode":"caPath := \"/etc/ssl/juicefs/ca.pem\" // value from tls-ca-cert-file\nif fi, err := os.Stat(caPath); err != nil || fi.IsDir() {\n    return fmt.Errorf(\"CA cert file %s is not a readable file\", caPath)\n}\nif f, err := os.Open(caPath); err != nil {\n    return fmt.Errorf(\"cannot read CA cert file %s: %w\", caPath, err)\n} else {\n    f.Close()\n}","typeGuard":null,"tryCatchPattern":"if _, err := os.ReadFile(caPath); err != nil {\n    // inspect err: os.IsNotExist vs permission vs is-a-directory\n    log.Fatalf(\"bad tls-ca-cert-file %s: %v\", caPath, err)\n}","preventionTips":["Validate the CA path exists before running the mount command.","In containers/K8s, mount the secret/configmap containing the CA at the exact referenced path.","Prefer the system trust store when the Redis CA is already trusted, and omit tls-ca-cert-file.","Pin cert files under a stable directory with consistent read permissions."],"tags":["tls","redis","file-read","configuration"],"backgroundTag":"file-read-failed","analyzedSha":"c9a67b23e8e08ec23ec331aa6f1675e2319e921c","analyzedAt":"2026-09-06T17:55:48.476Z","contentChangedAt":"2026-09-06T17:55:48.476Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}