{"record":{"id":"96f3b19c56098aed","repo":"gravitational/teleport","slug":"q-is-not-a-valid-x509-certificate-w-and-can-t","errorCode":null,"errorMessage":"%q is not a valid x509 certificate (%w) and can't be read as a file (%w)","messagePattern":"%q is not a valid x509 certificate \\(%w\\) and can't be read as a file \\(%w\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/config/fileconf.go","lineNumber":1533,"sourceCode":"\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tres[i] = pem\n\t}\n\treturn res, nil\n}\n\nfunc getCertificatePEM(certOrPath string) (string, error) {\n\t_, parseErr := tlsutils.ParseCertificatePEM([]byte(certOrPath))\n\tif parseErr == nil {\n\t\treturn certOrPath, nil // OK, valid inline PEM\n\t}\n\n\t// Try reading as a file and parsing that.\n\tdata, err := os.ReadFile(certOrPath)\n\tif err != nil {\n\t\t// Don't use trace in order to keep a clean error message.\n\t\treturn \"\", fmt.Errorf(\"%q is not a valid x509 certificate (%w) and can't be read as a file (%w)\", certOrPath, parseErr, err)\n\t}\n\tif _, err := tlsutils.ParseCertificatePEM(data); err != nil {\n\t\t// Don't use trace in order to keep a clean error message.\n\t\treturn \"\", fmt.Errorf(\"file %q contains an invalid x509 certificate: %w\", certOrPath, err)\n\t}\n\n\treturn string(data), nil // OK, valid PEM file\n}\n\n// DeviceTrust holds settings related to trusted device verification.\n// Requires Teleport Enterprise.\ntype DeviceTrust struct {\n\t// Mode is the trusted device verification mode.\n\t// Mirrors types.DeviceTrust.Mode.\n\tMode string `yaml:\"mode,omitempty\"`\n\t// AutoEnroll is the toggle for the device auto-enroll feature.\n\tAutoEnroll string `yaml:\"auto_enroll,omitempty\"`\n\t// EKCertAllowedCAs is an allow list of EKCert CAs. These may be specified","sourceCodeStart":1515,"sourceCodeEnd":1551,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/config/fileconf.go#L1515-L1551","documentation":"getCertificatePEM accepts either an inline PEM certificate or a path to a certificate file; this error fires when the value is neither — inline parsing failed and reading it as a file also failed — and reports both underlying errors.","triggerScenarios":"Thrown at lib/config/fileconf.go:1533 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the certificate value to be a valid inline PEM block or a readable file path","Check file permissions and that the path exists","Regenerate the certificate if it is corrupt"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}