{"record":{"id":"8e7d81c636eba4e8","repo":"fluent/fluentd","slug":"cert-path-does-not-contain-a-valid-certificate","errorCode":null,"errorMessage":"cert_path does not contain a valid certificate","messagePattern":"cert_path does not contain a valid certificate","errorType":"exception","errorClass":"Fluent::ConfigError","httpStatus":null,"severity":"error","filePath":"lib/fluent/plugin_helper/cert_option.rb","lineNumber":193,"sourceCode":"        cert, key = cert_option_generate_pair(generate_opts)\n        raise \"BUG: certificate digest algorithm not set\" unless generate_opts[:digest]\n\n        cert_option_add_extensions(cert, [\n          ['basicConstraints', 'CA:FALSE'],\n          ['nsCertType', 'server']\n        ])\n\n        cert.sign(key, generate_opts[:digest].to_s)\n        return cert, key, nil\n      end\n\n      def cert_option_certificates_from_file(path)\n        data = File.read(path)\n        pattern = Regexp.compile('-+BEGIN CERTIFICATE-+\\r?\\n(?:[^-]*\\r?\\n)+-+END CERTIFICATE-+\\r?\\n?', Regexp::MULTILINE)\n        list = []\n        data.scan(pattern){|match| list << OpenSSL::X509::Certificate.new(match) }\n        if list.length == 0\n          raise Fluent::ConfigError, \"cert_path does not contain a valid certificate\"\n        end\n        list\n      end\n    end\n  end\nend\n","sourceCodeStart":175,"sourceCodeEnd":200,"githubUrl":"https://github.com/fluent/fluentd/blob/dd45c6e18dc7be33b5e5a0f0767bf46307ff5626/lib/fluent/plugin_helper/cert_option.rb#L175-L200","documentation":"cert_option_certificates_from_file (cert_option.rb:187-195) reads cert_path and scans it for PEM blocks matching '-----BEGIN CERTIFICATE-----' ... '-----END CERTIFICATE-----'; if the regex finds none, it raises this Fluent::ConfigError. The file exists but holds no PEM certificate — it may be DER-encoded binary, a bare private key, an empty file, or the wrong file entirely — so OpenSSL::X509::Certificate can never be constructed from it.","triggerScenarios":"cert_path pointing at a DER (.crt binary) certificate: the PEM regex never matches; cert_path accidentally referencing the private key file (key.pem) instead of cert.pem; an empty or whitespace-only cert file from a failed secret mount; a file whose BEGIN/END lines are mangled by templating (e.g. leading spaces or missing dashes) so the pattern misses.","commonSituations":"Kubernetes secret volumes not mounted yet / mounted empty at container start; certs downloaded from a vendor in DER format; copy-paste of certificate contents truncating the footer; CRLF or indentation damage in config-managed cert files.","solutions":["Verify the file actually contains a PEM block: grep -c 'BEGIN CERTIFICATE' /etc/fluent/cert.pem must be >= 1","If the cert is DER, convert it: openssl x509 -inform der -in cert.der -out cert.pem and point cert_path at cert.pem","Fix path mix-ups: cert_path must reference the certificate, private_key_path the key","For secret volumes, ensure the mount is populated before fluentd starts (initContainer, correct secret name, no optional mounting of missing secrets)"],"exampleFix":"# before\n$ file /etc/fluent/cert.pem\n/etc/fluent/cert.pem: data   # DER binary\n# => cert_path does not contain a valid certificate\n\n# after\n$ openssl x509 -inform der -in /etc/fluent/cert.der -out /etc/fluent/cert.pem\n$ head -1 /etc/fluent/cert.pem\n-----BEGIN CERTIFICATE-----","handlingStrategy":"validation","validationCode":"data = File.read('/etc/fluent/cert.pem')\nraise 'no PEM certificate found' unless data.match?(/-+BEGIN CERTIFICATE-+/)","typeGuard":"def pem_cert_file?(path)\n  File.readable?(path) && File.read(path).match?(/-----BEGIN CERTIFICATE-----/)\nend","tryCatchPattern":"begin\n  agent.configure(conf)\nrescue Fluent::ConfigError => e\n  if e.message.include?('does not contain a valid certificate')\n    abort 'convert DER to PEM (openssl x509 -inform der) or fix the cert file, then restart'\n  end\n  raise\nend","preventionTips":["Standardize on PEM for all fluentd TLS material; convert DER with openssl x509 -inform der at provisioning","In Kubernetes, gate startup on secret volume contents (initContainer check for BEGIN CERTIFICATE) to catch empty mounts","Verify path wiring: cert_path is the certificate, private_key_path the key — mixed-up files fail here or at handshake"],"tags":["fluentd","tls","certificate","pem","config-error","startup"],"backgroundTag":"invalid-certificate-file","analyzedSha":"dd45c6e18dc7be33b5e5a0f0767bf46307ff5626","analyzedAt":"2026-08-21T16:22:07.332Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}