{"record":{"id":"8be256e50012f8f3","repo":"hashicorp/terraform","slug":"can-not-read-intermediate-certificate-from-s","errorCode":null,"errorMessage":"can not read intermediate certificate from %s","messagePattern":"can not read intermediate certificate from (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oci/auth.go","lineNumber":221,"sourceCode":"\t\t\treturn nil, fmt.Errorf(\"can not read leaf certificate from %s\", filepath.Join(certsDir, \"ip_cert.pem\"))\n\t\t}\n\n\t\tleafPrivateKeyBytes, err := getCertificateFileBytes(filepath.Join(certsDir, \"ip_key.pem\"))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can not read leaf private key from %s\", filepath.Join(certsDir, \"ip_key.pem\"))\n\t\t}\n\n\t\tleafPassphraseBytes := []byte{}\n\t\tif _, err := os.Stat(certsDir + \"/leaf_passphrase\"); !os.IsNotExist(err) {\n\t\t\tleafPassphraseBytes, err = getCertificateFileBytes(filepath.Join(certsDir + \"leaf_passphrase\"))\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"can not read leafPassphraseBytes from %s\", filepath.Join(certsDir+\"leaf_passphrase\"))\n\t\t\t}\n\t\t}\n\n\t\tintermediateCertificateBytes, err := getCertificateFileBytes(filepath.Join(certsDir, \"intermediate.pem\"))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can not read intermediate certificate from %s\", filepath.Join(certsDir, \"intermediate.pem\"))\n\t\t}\n\n\t\tintermediateCertificatesBytes := [][]byte{\n\t\t\tintermediateCertificateBytes,\n\t\t}\n\n\t\tcfg, err := auth.InstancePrincipalConfigurationWithCerts(common.StringToRegion(p.region), leafCertificateBytes, leafPassphraseBytes, leafPrivateKeyBytes, intermediateCertificatesBytes)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tlogger.Debug(\" Configuration provided by: %s\", cfg)\n\n\t\tconfigProviders = append(configProviders, cfg)\n\n\tcase strings.ToLower(AuthSecurityToken):\n\t\tlogger.Info(\"Attempting to authenticate using security token\")\n\t\tif p.region == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"can not get %s from Terraform configuration (SecurityToken)\", RegionAttrName)","sourceCodeStart":203,"sourceCodeEnd":239,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/backend/remote-state/oci/auth.go#L203-L239","documentation":"Returned during InstancePrincipalWithCerts setup when getCertificateFileBytes fails to read the intermediate certificate file (intermediate.pem). This certificate is part of the certificate chain required for the instance principal mTLS connection and is placed into the intermediateCertificatesBytes array.","triggerScenarios":"auth=\"InstancePrincipalWithCerts\" is set and {certsDir}/intermediate.pem is missing, unreadable, or the directory path is incorrect.","commonSituations":"Test certificate bundle is incomplete (leaf cert/key present but intermediate missing); test_certificates_location points to wrong directory; intermediate cert was not generated during cert setup.","solutions":["Ensure intermediate.pem exists in the certs directory alongside ip_cert.pem and ip_key.pem.","Set test_certificates_location to the directory containing the complete test certificate set.","Regenerate the full certificate chain including the intermediate certificate.","Verify read permissions on the file."],"exampleFix":"// before\n// certs dir missing intermediate.pem\n\n// after\nexport test_certificates_location=/home/user/test-certs\nls $test_certificates_location/intermediate.pem\nterraform init","handlingStrategy":"validation","validationCode":"func validateTestCerts(certsDir string) error {\n    files := map[string]string{\n        \"ip_cert.pem\":       \"leaf certificate\",\n        \"ip_key.pem\":        \"leaf private key\",\n        \"intermediate.pem\":  \"intermediate certificate\",\n    }\n    for f, desc := range files {\n        if _, err := os.ReadFile(filepath.Join(certsDir, f)); err != nil {\n            return fmt.Errorf(\"cannot read %s (%s): %w\", f, desc, err)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Pre-validate all certs:\nif err := validateTestCerts(certsDir); err != nil {\n    log.Fatal(err)\n}","preventionTips":["Generate the complete certificate chain (leaf + intermediate) as a set.","Validate all cert files exist and are readable before terraform init.","Document the full set of required cert files for InstancePrincipalWithCerts."],"tags":["oci","authentication","filesystem","certificates","instance-principal","terraform-backend"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}