{"record":{"id":"af029ba93f176d2b","repo":"zeroclaw-labs/zeroclaw","slug":"no-certificates-found-in-path","errorCode":null,"errorMessage":"no certificates found in {path}","messagePattern":"no certificates found in (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-gateway/src/tls.rs","lineNumber":172,"sourceCode":"    ) -> std::result::Result<rustls::client::danger::HandshakeSignatureValid, rustls::Error> {\n        self.inner.verify_tls13_signature(message, cert, dss)\n    }\n\n    fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {\n        self.inner.supported_verify_schemes()\n    }\n}\n\n/// Load PEM-encoded certificates from a file.\nfn load_certs(path: &str) -> Result<Vec<CertificateDer<'static>>> {\n    let file = std::fs::File::open(path)\n        .with_context(|| format!(\"cannot open certificate file: {path}\"))?;\n    let mut reader = std::io::BufReader::new(file);\n    let certs: Vec<CertificateDer<'static>> = rustls_pemfile::certs(&mut reader)\n        .collect::<std::result::Result<Vec<_>, _>>()\n        .with_context(|| format!(\"failed to parse PEM certificates from {path}\"))?;\n    if certs.is_empty() {\n        anyhow::bail!(\"no certificates found in {path}\");\n    }\n    Ok(certs)\n}\n\n/// Load a PEM-encoded private key from a file.\nfn load_private_key(path: &str) -> Result<PrivateKeyDer<'static>> {\n    let file = std::fs::File::open(path)\n        .with_context(|| format!(\"cannot open private key file: {path}\"))?;\n    let mut reader = std::io::BufReader::new(file);\n    let key = rustls_pemfile::private_key(&mut reader)\n        .with_context(|| format!(\"failed to parse private key from {path}\"))?\n        .ok_or_else(|| {\n            ::zeroclaw_log::record!(\n                ERROR,\n                ::zeroclaw_log::Event::new(module_path!(), ::zeroclaw_log::Action::Fail)\n                    .with_outcome(::zeroclaw_log::EventOutcome::Failure)\n                    .with_attrs(::serde_json::json!({\"path\": path})),\n                \"TLS private key file contains no key\"","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-gateway/src/tls.rs#L154-L190","documentation":"`load_certs` opens the file and parses PEM certificates with rustls-pemfile; separate contexts cover 'cannot open' and 'failed to parse'. This error is the third, distinct case: the file opened and parsed without error but contained zero `BEGIN CERTIFICATE` blocks. Typical causes are a private-key-only PEM, an empty file, or a non-PEM file passed where a certificate bundle was expected.","triggerScenarios":"Passing the key file where the certificate is expected (swapped cert/key config values); an empty or truncated certificate file; a DER-encoded file that is not PEM.","commonSituations":"Swapping TLS cert and key paths in config; a certificate file overwritten with key material; downloading the chain in DER instead of PEM from the CA.","solutions":["Inspect the file for `-----BEGIN CERTIFICATE-----` blocks; if absent, it is not a cert PEM","Check for swapped cert/key paths in the TLS configuration","Convert DER to PEM if needed: `openssl x509 -in cert.der -inform DER -out cert.pem`"],"exampleFix":"# before\ncert_path = \"config/server.key\"  # key file passed as cert\ncert_path = \"config/server.key\"\n# after\ncert_path = \"config/server.crt\"  # PEM containing BEGIN CERTIFICATE blocks\nkey_path = \"config/server.key\"","handlingStrategy":"validation","validationCode":"fn pem_has_certificates(path: &std::path::Path) -> bool {\n    std::fs::read_to_string(path)\n        .map(|s| s.contains(\"-----BEGIN CERTIFICATE-----\"))\n        .unwrap_or(false)\n}\n\nassert!(pem_has_certificates(cert_path), \"cert file contains no certificates\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use unambiguous file naming (server.crt vs server.key) so cert and key paths cannot be swapped","Verify certificates with `openssl x509 -in file -noout` before configuring TLS","Keep full-chain PEM (leaf + intermediates); keys-only PEMs trigger exactly this error"],"tags":["tls","pem","certificate","rustls","gateway"],"backgroundTag":"invalid-certificate","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}