{"record":{"id":"9701ccc9a95a9ad8","repo":"risingwavelabs/risingwave","slug":"failed-to-add-ca-certificate","errorCode":null,"errorMessage":"Failed to add CA certificate","messagePattern":"Failed to add CA certificate","errorType":"exception","errorClass":"PsqlError","httpStatus":null,"severity":"error","filePath":"src/utils/pgwire/src/ldap_auth.rs","lineNumber":108,"sourceCode":"\n    /// Initialize rustls ClientConfig based on TLS configuration\n    fn init_client_config(&self) -> PsqlResult<rustls::ClientConfig> {\n        let tls_client_config = rustls::ClientConfig::builder();\n\n        let mut root_cert_store = rustls::RootCertStore::empty();\n        if let Some(tls_config) = &self.ca_cert {\n            let ca_cert_bytes = fs::read(tls_config).map_err(|e| {\n                PsqlError::StartupError(anyhow!(e).context(\"Failed to read CA certificate\").into())\n            })?;\n            for cert in CertificateDer::pem_slice_iter(&ca_cert_bytes) {\n                let cert = cert.map_err(|e| {\n                    PsqlError::StartupError(\n                        anyhow!(e).context(\"Failed to parse CA certificate\").into(),\n                    )\n                })?;\n                root_cert_store.add(cert).map_err(|err| {\n                    PsqlError::StartupError(\n                        anyhow!(err).context(\"Failed to add CA certificate\").into(),\n                    )\n                })?;\n            }\n        } else {\n            // If ca certs is not present, load system native certs.\n            for cert in\n                rustls_native_certs::load_native_certs().expect(\"could not load platform certs\")\n            {\n                root_cert_store.add(cert).map_err(|err| {\n                    PsqlError::StartupError(\n                        anyhow!(err)\n                            .context(\"Failed to add native CA certificate\")\n                            .into(),\n                    )\n                })?;\n            }\n        }\n        let tls_client_config = tls_client_config.with_root_certificates(root_cert_store);","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/utils/pgwire/src/ldap_auth.rs#L90-L126","documentation":"A CA certificate parsed successfully but rustls's `RootCertStore::add` rejected it when adding it to the trust store. rustls rejects certificates it cannot use as trust anchors (e.g. not a valid CA certificate).","triggerScenarios":"`root_cert_store.add(cert)` returns Err in `init_client_config` — the parsed certificate is not a well-formed CA cert (missing CA basicConstraints, malformed extensions) or is otherwise unusable as a root.","commonSituations":"Configuring a leaf/end-entity certificate instead of the CA certificate; empty or unusual certificate files; certificates with unsupported extensions for rustls.","solutions":["Ensure the configured file is the CA (root/intermediate) certificate, not the client/server leaf certificate.","Check the certificate has basicConstraints CA:TRUE (`openssl x509 -in ca.pem -text | grep CA:`).","Re-export the correct CA certificate from your LDAP/PKI provider.","Read the inner rustls error from the anyhow context for the specific rejection reason."],"exampleFix":"// before: leaf server cert used as CA\nca_cert = \"server-leaf.pem\"\n// after: actual CA cert\nca_cert = \"corporate-root-ca.pem\"","handlingStrategy":"validation","validationCode":"// ensure the file is a CA cert before configuring\n// openssl x509 -in ca.pem -noout -text | grep -A1 'Basic Constraints'\n// expect: CA:TRUE","typeGuard":null,"tryCatchPattern":"match err {\n    PsqlError::StartupError(e) if e.to_string().contains(\"Failed to add CA certificate\") => {\n        eprintln!(\"certificate unusable as trust anchor: {}\", e);\n    }\n    other => return Err(other),\n}","preventionTips":["Configure the CA certificate, never a leaf/server certificate.","Verify CA:TRUE basicConstraints when exporting certs.","Keep a validated copy of the CA bundle in configuration management."],"tags":["ldap","tls","certificate","rustls"],"backgroundTag":"invalid-argument-value","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}