{"record":{"id":"77270667106774dc","repo":"larksuite/cli","slug":"failed-to-load-system-cert-pool-for-s-w","errorCode":null,"errorMessage":"failed to load system cert pool for %s: %w","messagePattern":"failed to load system cert pool for (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/transport/tls_ca.go","lineNumber":48,"sourceCode":"\t\tTargetPath:            caPath,\n\t\tLabel:                 envvars.CliCAPath,\n\t\tAllowReadableByOthers: true,\n\t})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unsafe %s %q: %w\", envvars.CliCAPath, caPath, err)\n\t}\n\tpemBytes, err := vfs.ReadFile(safeCAPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to read %s %q: %w\", envvars.CliCAPath, caPath, err)\n\t}\n\n\t// Augment the system trust store. Do NOT silently discard a SystemCertPool\n\t// error: falling back to an empty pool would make this transport trust ONLY\n\t// the extra CA (dropping all system roots), which narrows trust unexpectedly\n\t// and could break TLS to legitimate endpoints. Fail closed instead.\n\tpool, err := x509.SystemCertPool()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to load system cert pool for %s: %w\", envvars.CliCAPath, err)\n\t}\n\tif pool == nil {\n\t\tpool = x509.NewCertPool()\n\t}\n\tif ok := pool.AppendCertsFromPEM(pemBytes); !ok {\n\t\treturn fmt.Errorf(\"invalid %s %q: no certificates parsed from PEM\", envvars.CliCAPath, caPath)\n\t}\n\n\tif t.TLSClientConfig == nil {\n\t\tt.TLSClientConfig = &tls.Config{}\n\t} else {\n\t\t// Clone to avoid mutating shared config from the base transport.\n\t\tt.TLSClientConfig = t.TLSClientConfig.Clone()\n\t}\n\tif t.TLSClientConfig.MinVersion == 0 || t.TLSClientConfig.MinVersion < tls.VersionTLS12 {\n\t\tt.TLSClientConfig.MinVersion = tls.VersionTLS12\n\t}\n\tt.TLSClientConfig.RootCAs = pool","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/transport/tls_ca.go#L30-L66","documentation":"x509.SystemCertPool() failed while augmenting the system trust store for the extra CA. The code deliberately fails closed instead of silently falling back to an empty pool, which would make the transport trust ONLY the extra CA and drop all system roots.","triggerScenarios":"applyExtraRootCA calls x509.SystemCertPool() after successfully reading the PEM file and the OS returns an error (rare; often on constrained/embedded systems or broken crypto configuration).","commonSituations":"Minimal container images with no system certificate directory (e.g. missing /etc/ssl/certs); exotic platforms where SystemCertPool is unsupported; corrupted system trust store.","solutions":["Install the OS CA certificates package (e.g. ca-certificates on Debian/Alpine images).","Recreate or repair the system trust store (/etc/ssl/certs, update-ca-certificates / update-ca-trust).","Re-run the command after the system roots are available."],"exampleFix":"// before (Dockerfile)\nFROM alpine\n// after (Dockerfile)\nFROM alpine\nRUN apk add --no-cache ca-certificates","handlingStrategy":"fallback","validationCode":"if _, err := x509.SystemCertPool(); err != nil {\n\tlog.Printf(\"warning: system cert pool unavailable: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"if _, err := x509.SystemCertPool(); err != nil {\n\tlog.Fatalf(\"system trust store broken (%v); install ca-certificates before running the CLI\", err)\n}","preventionTips":["Install the ca-certificates package in slim container images.","Run update-ca-certificates / update-ca-trust as part of image build.","Smoke-test TLS to a known endpoint during deployment health checks."],"tags":["tls","certificate","system"],"backgroundTag":"system-cert-pool-load-failed","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}