{"record":{"id":"9ef108dd842f28af","repo":"hyperledger/fabric","slug":"error-adding-root-certificate","errorCode":null,"errorMessage":"error adding root certificate","messagePattern":"error adding root certificate","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/pkg/comm/config.go","lineNumber":235,"sourceCode":"\tServerNameOverride string\n}\n\nfunc (so SecureOptions) TLSConfig() (*tls.Config, error) {\n\t// if TLS is not enabled, return\n\tif !so.UseTLS {\n\t\treturn nil, nil\n\t}\n\n\ttlsConfig := &tls.Config{\n\t\tMinVersion:            tls.VersionTLS12,\n\t\tServerName:            so.ServerNameOverride,\n\t\tVerifyPeerCertificate: so.VerifyCertificate,\n\t}\n\tif len(so.ServerRootCAs) > 0 {\n\t\ttlsConfig.RootCAs = x509.NewCertPool()\n\t\tfor _, certBytes := range so.ServerRootCAs {\n\t\t\tif !tlsConfig.RootCAs.AppendCertsFromPEM(certBytes) {\n\t\t\t\treturn nil, errors.New(\"error adding root certificate\")\n\t\t\t}\n\t\t}\n\t}\n\n\tif so.RequireClientCert {\n\t\tcert, err := so.ClientCertificate()\n\t\tif err != nil {\n\t\t\treturn nil, errors.WithMessage(err, \"failed to load client certificate\")\n\t\t}\n\t\ttlsConfig.Certificates = append(tlsConfig.Certificates, cert)\n\t}\n\n\tif so.TimeShift > 0 {\n\t\ttlsConfig.Time = func() time.Time {\n\t\t\treturn time.Now().Add((-1) * so.TimeShift)\n\t\t}\n\t}\n","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/internal/pkg/comm/config.go#L217-L253","documentation":"SecureOptions.TLSConfig guard: one of the PEM blobs in ServerRootCAs could not be appended to the x509 cert pool (AppendCertsFromPEM returned false), meaning the bytes are not a parseable PEM certificate. The at-fault input is that ServerRootCAs entry.","triggerScenarios":"Thrown at internal/pkg/comm/config.go:235 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify each entry in ServerRootCAs is valid PEM-encoded X.509","Check for truncated or concatenated-with-junk certificate files","Regenerate or re-download the CA certificate"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}