{"record":{"id":"8c3320675d8c03b5","repo":"hashicorp/terraform","slug":"failed-to-append-certs","errorCode":null,"errorMessage":"failed to append certs","messagePattern":"failed to append certs","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/http/backend.go","lineNumber":294,"sourceCode":"\t\treturn fmt.Errorf(\"client_certificate_pem is set but client_private_key_pem is not\")\n\t}\n\tif clientPrivateKeyPem != \"\" && clientCertificatePem == \"\" {\n\t\treturn fmt.Errorf(\"client_private_key_pem is set but client_certificate_pem is not\")\n\t}\n\n\t// TLS configuration is needed; create an object and configure it\n\tvar tlsConfig tls.Config\n\tclient.HTTPClient.Transport.(*http.Transport).TLSClientConfig = &tlsConfig\n\n\tif skipCertVerification {\n\t\t// ignores TLS verification\n\t\ttlsConfig.InsecureSkipVerify = true\n\t}\n\tif clientCACertificatePem != \"\" {\n\t\t// trust servers based on a CA\n\t\ttlsConfig.RootCAs = x509.NewCertPool()\n\t\tif !tlsConfig.RootCAs.AppendCertsFromPEM([]byte(clientCACertificatePem)) {\n\t\t\treturn errors.New(\"failed to append certs\")\n\t\t}\n\t}\n\tif clientCertificatePem != \"\" && clientPrivateKeyPem != \"\" {\n\t\t// attach a client certificate to the TLS handshake (aka mTLS)\n\t\tcertificate, err := tls.X509KeyPair([]byte(clientCertificatePem), []byte(clientPrivateKeyPem))\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"cannot load client certificate: %w\", err)\n\t\t}\n\t\ttlsConfig.Certificates = []tls.Certificate{certificate}\n\t}\n\n\treturn nil\n}\n\nfunc (b *Backend) StateMgr(name string) (statemgr.Full, tfdiags.Diagnostics) {\n\tvar diags tfdiags.Diagnostics\n\n\tif name != backend.DefaultStateName {","sourceCodeStart":276,"sourceCodeEnd":312,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/backend/remote-state/http/backend.go#L276-L312","documentation":"Returned by configureTLS (internal/backend/remote-state/http/backend.go:294) when tlsConfig.RootCAs.AppendCertsFromPEM([]byte(clientCACertificatePem)) returns false. AppendCertsFromPEM returns false when the provided PEM data contains no parseable certificates, so the http backend refuses to configure a trust store built from garbage. This only triggers when client_ca_certificate_pem (or TF_HTTP_CLIENT_CA_CERTIFICATE_PEM) is set.","triggerScenarios":"Configuring the http backend with client_ca_certificate_pem set to a value that is not valid PEM, is truncated, contains only a private key, or has non-certificate PEM blocks; or TF_HTTP_CLIENT_CA_CERTIFICATE_PEM pointing at malformed content.","commonSituations":"Pasting only the human-readable header of a CA cert; copying an intermediate/key instead of the CA; trailing/leading whitespace or encoding corruption from env var transport; using a file path instead of inline PEM content (the field expects the PEM text, not a path).","solutions":["Provide the full, valid PEM-encoded CA certificate chain in client_ca_certificate_pem (BEGIN CERTIFICATE ... END CERTIFICATE).","Validate the PEM decodes to at least one x509 certificate before configuring the backend.","If the content is a path, read the file and inline its contents into the attribute."],"exampleFix":"// before: malformed/empty CA pem\nbackend \"http\" {\n  address                  = \"https://state.example\"\n  client_ca_certificate_pem = \"\"\n}\n\n// after: full PEM body\nbackend \"http\" {\n  address                  = \"https://state.example\"\n  client_ca_certificate_pem = <<-EOT\n-----BEGIN CERTIFICATE-----\nMIIDazCCAlOgAwIBAgIUM...full CA cert...\n-----END CERTIFICATE-----\nEOT\n}","handlingStrategy":"validation","validationCode":"// Validate the PEM before configuring the backend.\npool := x509.NewCertPool()\nif !pool.AppendCertsFromPEM([]byte(caPem)) {\n    return fmt.Errorf(\"client_ca_certificate_pem contains no parseable certificates\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Inline the full PEM body (BEGIN/END CERTIFICATE), not a file path.","Validate PEM decodes to at least one cert with x509.NewCertPool().AppendCertsFromPEM before use.","Prefer loading CA bundles via a known-good source rather than hand-pasting."],"tags":["backend","http","tls","certificates","configuration"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}