{"record":{"id":"8eb487c194ae7e0a","repo":"VictoriaMetrics/VictoriaMetrics","slug":"cannot-parse-data-read-from-ca-file-q","errorCode":null,"errorMessage":"cannot parse data read from `ca_file` %q","messagePattern":"cannot parse data read from `ca_file` %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/promauth/config.go","lineNumber":985,"sourceCode":"\t\trootCA := x509.NewCertPool()\n\t\tif !rootCA.AppendCertsFromPEM([]byte(tc.CA)) {\n\t\t\treturn fmt.Errorf(\"cannot parse data from `ca` value\")\n\t\t}\n\t\ttctx.getTLSRootCA = func() (*x509.CertPool, error) {\n\t\t\treturn rootCA, nil\n\t\t}\n\t\th := xxhash.Sum64([]byte(tc.CA))\n\t\ttctx.tlsRootCADigest = fmt.Sprintf(\"digest(CA)=%d\", h)\n\t} else if tc.CAFile != \"\" {\n\t\tpath := fscore.GetFilepath(baseDir, tc.CAFile)\n\t\ttctx.getTLSRootCA = func() (*x509.CertPool, error) {\n\t\t\tdata, err := fscore.ReadFileOrHTTP(path)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"cannot read `ca_file`: %w\", err)\n\t\t\t}\n\t\t\trootCA := x509.NewCertPool()\n\t\t\tif !rootCA.AppendCertsFromPEM(data) {\n\t\t\t\treturn nil, fmt.Errorf(\"cannot parse data read from `ca_file` %q\", tc.CAFile)\n\t\t\t}\n\t\t\treturn rootCA, nil\n\t\t}\n\t\ttctx.tlsRootCADigest = fmt.Sprintf(\"caFile=%q\", tc.CAFile)\n\t}\n\tv, err := netutil.ParseTLSVersion(tc.MinVersion)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannot parse `min_version`: %w\", err)\n\t}\n\ttctx.minVersion = v\n\treturn nil\n}\n","sourceCodeStart":967,"sourceCodeEnd":998,"githubUrl":"https://github.com/VictoriaMetrics/VictoriaMetrics/blob/5079fb58f1e8e62113f90c945ad71586c797d770/lib/promauth/config.go#L967-L998","documentation":"Returned by the getTLSRootCA closure when `ca_file` was read successfully but its contents contain no parseable PEM certificates (AppendCertsFromPEM returned false). Distinguishes 'file unreadable' (521) from 'file readable but not a valid CA cert'.","triggerScenarios":"ca_file contains an empty file, a private key instead of a certificate, a DER/ binary cert, a PKCS#12 bundle, base64-encoded PEM, or only intermediate/leaf certs not recognized as parseable PEM.","commonSituations":"Pointing ca_file at the client key or cert chain position swapped; exporting a Windows/PFX cert without converting (`openssl x509 -in cert.crt -inform der -out ca.pem`); writing a CSR or public key instead of the CA cert; a truncated download.","solutions":["Run `openssl x509 -in <ca_file> -noout` to verify it is a valid PEM certificate; re-export in PEM format if it fails","Convert DER/PFX to PEM: `openssl x509 -inform der -in cert.der -out ca.pem` or `openssl pkcs12 -in bundle.pfx -nokeys -out ca.pem`","Ensure the file holds the CA certificate, not the private key or CSR (look for '-----BEGIN CERTIFICATE-----')","Re-download or re-copy the file if it is empty/truncated"],"exampleFix":"# before\nopenssl pkcs12 -in ca.pfx -nodes -out ca.pem   # key+cert, may fail pool\n# after\nopenssl pkcs12 -in ca.pfx -nokeys -cacerts -out ca.pem","handlingStrategy":"validation","validationCode":"data, err := os.ReadFile(cfg.TLS.CAFile)\nif err != nil {\n\treturn err\n}\nif !x509.NewCertPool().AppendCertsFromPEM(data) {\n\treturn fmt.Errorf(\"ca_file %q does not contain a valid PEM certificate\", cfg.TLS.CAFile)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify with `openssl x509 -noout -in ca.pem` before deploying; it fails fast on DER/PFX/key files","Keep CA certs and private keys in separate files to avoid pointing ca_file at the key","Convert binary certs (DER, PFX) to PEM explicitly during provisioning","Check the file is non-empty after mounts/secrets sync (empty files are common with failed mounts)"],"tags":["tls","x509","pem","ca-certificate"],"backgroundTag":"invalid-tls-ca-certificate","analyzedSha":"5079fb58f1e8e62113f90c945ad71586c797d770","analyzedAt":"2026-09-03T18:10:26.153Z","contentChangedAt":"2026-09-03T18:10:26.153Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}