{"record":{"id":"9c7e7241349d70de","repo":"hyperledger/fabric","slug":"error-loading-client-root-cas-s","errorCode":null,"errorMessage":"error loading client root CAs (%s)","messagePattern":"error loading client root CAs \\((.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/peer/config.go","lineNumber":416,"sourceCode":"\t\tif err != nil {\n\t\t\treturn serverConfig, fmt.Errorf(\"error loading TLS key (%s)\", err)\n\t\t}\n\t\tserverCert, err := os.ReadFile(config.GetPath(\"peer.tls.cert.file\"))\n\t\tif err != nil {\n\t\t\treturn serverConfig, fmt.Errorf(\"error loading TLS certificate (%s)\", err)\n\t\t}\n\t\tserverConfig.SecOpts.Certificate = serverCert\n\t\tserverConfig.SecOpts.Key = serverKey\n\t\tserverConfig.SecOpts.RequireClientCert = viper.GetBool(\"peer.tls.clientAuthRequired\")\n\t\tif serverConfig.SecOpts.RequireClientCert {\n\t\t\tvar clientRoots [][]byte\n\t\t\tfor _, file := range viper.GetStringSlice(\"peer.tls.clientRootCAs.files\") {\n\t\t\t\tclientRoot, err := os.ReadFile(\n\t\t\t\t\tconfig.TranslatePath(filepath.Dir(viper.ConfigFileUsed()), file),\n\t\t\t\t)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn serverConfig,\n\t\t\t\t\t\tfmt.Errorf(\"error loading client root CAs (%s)\", err)\n\t\t\t\t}\n\t\t\t\tclientRoots = append(clientRoots, clientRoot)\n\t\t\t}\n\t\t\tserverConfig.SecOpts.ClientRootCAs = clientRoots\n\t\t}\n\t\t// check for root cert\n\t\tif config.GetPath(\"peer.tls.rootcert.file\") != \"\" {\n\t\t\trootCert, err := os.ReadFile(config.GetPath(\"peer.tls.rootcert.file\"))\n\t\t\tif err != nil {\n\t\t\t\treturn serverConfig, fmt.Errorf(\"error loading TLS root certificate (%s)\", err)\n\t\t\t}\n\t\t\tserverConfig.SecOpts.ServerRootCAs = [][]byte{rootCert}\n\t\t}\n\t}\n\t// get the default keepalive options\n\tserverConfig.KaOpts = comm.DefaultKeepaliveOptions\n\t// check to see if interval is set for the env\n\tif viper.IsSet(\"peer.keepalive.interval\") {","sourceCodeStart":398,"sourceCodeEnd":434,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/peer/config.go#L398-L434","documentation":"Returned by peer GetServerConfig when loading the client root CA files (peer.tls.clientRootCAs.files) fails while client authentication is required. One of the listed CA files is missing or unreadable, blocking mutual-TLS server setup.","triggerScenarios":"Thrown at core/peer/config.go:416 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check every file in peer.tls.clientRootCAs.files exists and is a valid PEM CA cert","Fix paths/permissions in core.yaml"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}