{"record":{"id":"9359f1ff3ac2cd5f","repo":"hashicorp/terraform","slug":"can-not-read-leaf-certificate-from-s","errorCode":null,"errorMessage":"can not read leaf certificate from %s","messagePattern":"can not read leaf certificate from (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/backend/remote-state/oci/auth.go","lineNumber":203,"sourceCode":"\t\tlogger.Debug(\" Configuration provided by: %s\", cfg)\n\n\t\tconfigProviders = append(configProviders, cfg)\n\tcase strings.ToLower(AuthInstancePrincipalWithCertsSetting):\n\t\tlogger.Info(\"Attempting to authenticate using instance principal with certificates\")\n\n\t\tif p.region == \"\" {\n\t\t\treturn nil, fmt.Errorf(\"unable to determine region from Terraform backend configuration while using Instance Principal with certificates\")\n\t\t}\n\n\t\tdefaultCertsDir, err := os.Getwd()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can not get working directory for current os platform\")\n\t\t}\n\n\t\tcertsDir := filepath.Clean(getEnvSettingWithDefault(\"test_certificates_location\", defaultCertsDir))\n\t\tleafCertificateBytes, err := getCertificateFileBytes(filepath.Join(certsDir, \"ip_cert.pem\"))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can not read leaf certificate from %s\", filepath.Join(certsDir, \"ip_cert.pem\"))\n\t\t}\n\n\t\tleafPrivateKeyBytes, err := getCertificateFileBytes(filepath.Join(certsDir, \"ip_key.pem\"))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can not read leaf private key from %s\", filepath.Join(certsDir, \"ip_key.pem\"))\n\t\t}\n\n\t\tleafPassphraseBytes := []byte{}\n\t\tif _, err := os.Stat(certsDir + \"/leaf_passphrase\"); !os.IsNotExist(err) {\n\t\t\tleafPassphraseBytes, err = getCertificateFileBytes(filepath.Join(certsDir + \"leaf_passphrase\"))\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"can not read leafPassphraseBytes from %s\", filepath.Join(certsDir+\"leaf_passphrase\"))\n\t\t\t}\n\t\t}\n\n\t\tintermediateCertificateBytes, err := getCertificateFileBytes(filepath.Join(certsDir, \"intermediate.pem\"))\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"can not read intermediate certificate from %s\", filepath.Join(certsDir, \"intermediate.pem\"))","sourceCodeStart":185,"sourceCodeEnd":221,"githubUrl":"https://github.com/hashicorp/terraform/blob/d32a084675427f5ac3f7d2868578ef8b2c1dc525/internal/backend/remote-state/oci/auth.go#L185-L221","documentation":"Returned during InstancePrincipalWithCerts setup when getCertificateFileBytes fails to read the leaf certificate file (ip_cert.pem) from the certificates directory. The certs directory defaults to the working directory or is overridden by the test_certificates_location environment variable.","triggerScenarios":"auth=\"InstancePrincipalWithCerts\" is set and the file {certsDir}/ip_cert.pem does not exist, is not readable, or the certs directory path is wrong.","commonSituations":"test_certificates_location env var points to the wrong directory; certificates were not generated/copied for local testing; working directory is not where the test certs live; permission issue on the file.","solutions":["Ensure ip_cert.pem exists in the certificates directory: ls -la $certsDir/ip_cert.pem.","Set the test_certificates_location environment variable to the correct absolute directory containing the test certs.","Generate or copy the test certificate files into the expected directory.","Verify file permissions allow read access by the terraform process."],"exampleFix":"// before\n// test_certificates_location not set, working dir has no ip_cert.pem\n\n// after\nexport test_certificates_location=/home/user/test-certs\nterraform init","handlingStrategy":"validation","validationCode":"func validateTestCerts(certsDir string) error {\n    required := []string{\"ip_cert.pem\", \"ip_key.pem\", \"intermediate.pem\"}\n    for _, f := range required {\n        p := filepath.Join(certsDir, f)\n        if _, err := os.Stat(p); err != nil {\n            return fmt.Errorf(\"missing test cert %s: %w\", p, err)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Validate test certs before init:\ncertsDir := os.Getenv(\"test_certificates_location\")\nif certsDir == \"\" {\n    certsDir, _ = os.Getwd()\n}\nif err := validateTestCerts(certsDir); err != nil {\n    log.Fatal(err)\n}","preventionTips":["Set test_certificates_location to an explicit absolute path.","Pre-validate all required cert files exist before running terraform.","Keep test certificate generation scripts alongside your test suite."],"tags":["oci","authentication","filesystem","certificates","instance-principal","terraform-backend"],"backgroundTag":null,"analyzedSha":"d32a084675427f5ac3f7d2868578ef8b2c1dc525","analyzedAt":"2026-08-11T18:43:52.779Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}