{"record":{"id":"8d03a10967bcaa13","repo":"cloudflare/cloudflared","slug":"unable-to-create-tls-config-to-connect-with-edge","errorCode":null,"errorMessage":"unable to create TLS config to connect with edge","messagePattern":"unable to create TLS config to connect with edge","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cmd/cloudflared/tunnel/configuration.go","lineNumber":162,"sourceCode":"\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\n\tprotocolSelector, err := connection.NewProtocolSelector(transportProtocol, log)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\tlog.Info().Msgf(\"Initial protocol %s\", protocolSelector.Current())\n\n\tedgeTLSConfigs := make(map[connection.Protocol]*tls.Config, len(connection.ProtocolList))\n\tfor _, p := range connection.ProtocolList {\n\t\ttlsSettings := p.TLSSettings()\n\t\tif tlsSettings == nil {\n\t\t\treturn nil, nil, fmt.Errorf(\"%s has unknown TLS settings\", p)\n\t\t}\n\t\tedgeTLSConfig, err := tlsconfig.CreateTunnelConfig(c.String(flags.CACert), tlsSettings.ServerName)\n\t\tif err != nil {\n\t\t\treturn nil, nil, errors.Wrap(err, \"unable to create TLS config to connect with edge\")\n\t\t}\n\t\tif len(tlsSettings.NextProtos) > 0 {\n\t\t\tedgeTLSConfig.NextProtos = tlsSettings.NextProtos\n\t\t}\n\t\tedgeTLSConfigs[p] = edgeTLSConfig\n\t}\n\n\tgracePeriod, err := gracePeriod(c)\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\tedgeIPVersion, err := parseConfigIPVersion(c.String(flags.EdgeIpVersion))\n\tif err != nil {\n\t\treturn nil, nil, err\n\t}\n\tedgeBindAddr, err := parseConfigBindAddress(c.String(flags.EdgeBindAddress))\n\tif err != nil {\n\t\treturn nil, nil, err","sourceCodeStart":144,"sourceCodeEnd":180,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/tunnel/configuration.go#L144-L180","documentation":"When building per-protocol edge TLS configs in prepareTunnelConfig, tlsconfig.CreateTunnelConfig fails while constructing the *tls.Config used to dial Cloudflare's edge. This usually stems from a bad --cacert file, unreadable CA pool, or invalid TLS settings for the protocol. The failure aborts tunnel startup since no edge connection can be made securely.","triggerScenarios":"Running with --cacert pointing to a missing, unreadable, or invalid PEM file; origin/edge TLS settings in config producing an unusable ServerName; internal error inside CreateTunnelConfig (e.g. loading the CA pool).","commonSituations":"Pointing --cacert at the origin certificate instead of a CA bundle; file permission problems in containers; stale config after rotating certificates; TLS settings in the tunnel token that reference an unknown server name.","solutions":["Verify the --cacert path exists, is readable, and contains valid PEM certificates (openssl x509 -in file -noout -text).","Remove --cacert if you are not using a custom CA (default Cloudflare CA is used).","Fix the tlsSettings/server name supplied by your tunnel configuration or token.","Re-authenticate (`cloudflared tunnel login`) to regenerate valid certificate material."],"exampleFix":"// before\ncloudflared tunnel run --cacert /etc/cloudflared/missing.pem my-tunnel\n// after\ncloudflared tunnel run --cacert /etc/cloudflared/ca.pem my-tunnel  # valid PEM CA bundle","handlingStrategy":"validation","validationCode":"// verify the CA cert file before starting\nfunc caCertReadable(path string) error {\n\tif path == \"\" { return nil } // default CA used\n\tpem, err := os.ReadFile(path)\n\tif err != nil { return err }\n\tif !bytes.Contains(pem, []byte(\"BEGIN CERTIFICATE\")) {\n\t\treturn fmt.Errorf(\"%s is not a PEM CA bundle\", path)\n\t}\n\treturn nil\n}","typeGuard":null,"tryCatchPattern":"edgeTLSConfig, err := tlsconfig.CreateTunnelConfig(c.String(flags.CACert), tlsSettings.ServerName)\nif err != nil {\n\treturn nil, nil, errors.Wrap(err, \"unable to create TLS config to connect with edge\")\n}","preventionTips":["Validate cert files with openssl before deploying","Ensure cert files are readable by the cloudflared process user","Re-run `cloudflared tunnel login` after certificate rotation","Do not pass an origin cert as --cacert"],"tags":["tls","network","configuration","certificates"],"backgroundTag":"file-not-found","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}