{"record":{"id":"7570e9b47d7899ef","repo":"docker/cli","slug":"unable-to-get-system-cert-pool-w-7570e9","errorCode":null,"errorMessage":"unable to get system cert pool: %w","messagePattern":"unable to get system cert pool: %w","errorType":"exception","errorClass":"invalidParameterErr","httpStatus":null,"severity":"error","filePath":"internal/registry/registry.go","lineNumber":80,"sourceCode":"func loadTLSConfig(ctx context.Context, directory string, tlsConfig *tls.Config) error {\n\tfs, err := os.ReadDir(directory)\n\tif err != nil {\n\t\tif os.IsNotExist(err) {\n\t\t\treturn nil\n\t\t}\n\t\treturn invalidParam(err)\n\t}\n\n\tfor _, f := range fs {\n\t\tif ctx.Err() != nil {\n\t\t\treturn ctx.Err()\n\t\t}\n\t\tswitch filepath.Ext(f.Name()) {\n\t\tcase \".crt\":\n\t\t\tif tlsConfig.RootCAs == nil {\n\t\t\t\tsystemPool, err := x509.SystemCertPool()\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn invalidParam(fmt.Errorf(\"unable to get system cert pool: %w\", err))\n\t\t\t\t}\n\t\t\t\ttlsConfig.RootCAs = systemPool\n\t\t\t}\n\t\t\tfileName := filepath.Join(directory, f.Name())\n\t\t\tlog.G(ctx).Debugf(\"crt: %s\", fileName)\n\t\t\tdata, err := os.ReadFile(fileName)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\ttlsConfig.RootCAs.AppendCertsFromPEM(data)\n\t\tcase \".cert\":\n\t\t\tcertName := f.Name()\n\t\t\tkeyName := certName[:len(certName)-5] + \".key\"\n\t\t\tlog.G(ctx).Debugf(\"cert: %s\", filepath.Join(directory, certName))\n\t\t\tif !hasFile(fs, keyName) {\n\t\t\t\treturn invalidParamf(\"missing key %s for client certificate %s. CA certificates must use the extension .crt\", keyName, certName)\n\t\t\t}\n\t\t\tcert, err := tls.LoadX509KeyPair(filepath.Join(directory, certName), filepath.Join(directory, keyName))","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/internal/registry/registry.go#L62-L98","documentation":"Returned by loadTLSConfig when x509.SystemCertPool() fails while processing a .crt file in the registry TLS directory. SystemCertPool reads the OS trust store; failure (wrapped with invalidParam) means the CLI cannot establish a trusted TLS root set for the registry.","triggerScenarios":"Configuring a registry with TLS certs (a .crt in /etc/docker/certs.d/<host>/) on a system where the trust store cannot be loaded — missing CA bundle file, unreadable /etc/ssl/certs, minimal/container OS without ca-certificates.","commonSituations":"Scratch/minimal containers or Alpine without ca-certificates installed; custom $SSL_CERT_FILE pointing at a missing file; permission denied on system CA bundle; unusual platform without a known cert pool.","solutions":["Install the OS CA bundle (e.g. `apt-get install ca-certificates`, `apk add ca-certificates`).","Ensure $SSL_CERT_FILE / $SSL_CERT_DIR point to existing, readable files/dirs.","Fix permissions on the system trust store (/etc/ssl/certs).","Provide the full CA chain via the .crt in certs.d so SystemCertPool fallback is supplemented."],"exampleFix":"# before (alpine, no ca-certificates)\ndocker pull myregistry/app\n# unable to get system cert pool\n# after\napk add --no-cache ca-certificates\ndocker pull myregistry/app","handlingStrategy":"try-catch","validationCode":"// ensure a trust store exists before configuring registry TLS\nif _, err := x509.SystemCertPool(); err != nil { installCABundle() }","typeGuard":null,"tryCatchPattern":"if strings.Contains(err.Error(), \"unable to get system cert pool\") { installCaCertificates(); retry }","preventionTips":["Install ca-certificates in minimal/container images.","Set valid $SSL_CERT_FILE / $SSL_CERT_DIR.","Keep system trust store readable."],"tags":["registry","tls","certificates","trust-store","config","docker"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}