{"record":{"id":"7ab858324b7cc004","repo":"yudai/gotty","slug":"could-not-open-ca-crt-file-s","errorCode":null,"errorMessage":"could not open CA crt file %s","messagePattern":"could not open CA crt file (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/server.go","lineNumber":235,"sourceCode":"\t\tHandler: handler,\n\t}\n\n\tif server.options.EnableTLSClientAuth {\n\t\ttlsConfig, err := server.tlsConfig()\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrapf(err, \"failed to setup TLS configuration\")\n\t\t}\n\t\tsrv.TLSConfig = tlsConfig\n\t}\n\n\treturn srv, nil\n}\n\nfunc (server *Server) tlsConfig() (*tls.Config, error) {\n\tcaFile := homedir.Expand(server.options.TLSCACrtFile)\n\tcaCert, err := ioutil.ReadFile(caFile)\n\tif err != nil {\n\t\treturn nil, errors.New(\"could not open CA crt file \" + caFile)\n\t}\n\tcaCertPool := x509.NewCertPool()\n\tif !caCertPool.AppendCertsFromPEM(caCert) {\n\t\treturn nil, errors.New(\"could not parse CA crt file data in \" + caFile)\n\t}\n\ttlsConfig := &tls.Config{\n\t\tClientCAs:  caCertPool,\n\t\tClientAuth: tls.RequireAndVerifyClientCert,\n\t}\n\treturn tlsConfig, nil\n}\n","sourceCodeStart":217,"sourceCodeEnd":247,"githubUrl":"https://github.com/yudai/gotty/blob/a080c85cbc59226c94c6941ad8c395232d72d517/server/server.go#L217-L247","documentation":"tlsConfig() expands TLSCACrtFile with homedir.Expand and reads it with ioutil.ReadFile. If the read fails (missing file, bad path, permissions), it returns this plain error containing the expanded path. Note the homedir.Expand error itself is ignored, so '~' that cannot be expanded silently yields a literal '~...' path.","triggerScenarios":"Calling Run() with EnableTLSClientAuth=true when TLSCACrtFile does not exist, is a directory, or is not readable by the current user.","commonSituations":"Typo in the cert path; '~' not expanding when running under a service account with no HOME; cert never provisioned in a container image.","solutions":["Check the path in the error message exists: ls -l <path>","Fix tls_ca_crt_file in your config/flags to the real CA bundle path","Verify file permissions for the user running GoTTY","If using '~', ensure HOME is set for the process"],"exampleFix":"// before\ntls_ca_crt_file = \"~/ca.crt\"  # HOME unset in systemd unit\n// after\ntls_ca_crt_file = \"/home/gotty/ca.crt\"","handlingStrategy":"validation","validationCode":"caPath := expandHome(opts.TLSCACrtFile)\nif fi, err := os.Stat(caPath); err != nil || fi.IsDir() {\n    log.Fatalf(\"CA file %q not accessible\", caPath)\n}","typeGuard":null,"tryCatchPattern":"if err := srv.Run(ctx); err != nil {\n    if strings.Contains(err.Error(), \"could not open CA crt file\") {\n        log.Fatalf(\"CA file missing: %v\", err)\n    }\n}","preventionTips":["Use absolute paths for cert files in service/container environments","Ensure HOME is set if you rely on '~' expansion","Verify file readability as the runtime user after deployment"],"tags":["tls","file-io","configuration"],"backgroundTag":"ca-cert-file-not-found","analyzedSha":"a080c85cbc59226c94c6941ad8c395232d72d517","analyzedAt":"2026-09-02T16:42:38.150Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T21:17:11.164Z"}