{"record":{"id":"af7862f7570d3a4e","repo":"risingwavelabs/risingwave","slug":"parse-ca-file-error-0","errorCode":null,"errorMessage":"parse ca file error: {0}","messagePattern":"parse ca file error: (.+?)","errorType":"exception","errorClass":"SchemaRegistryClientError::ParsePem","httpStatus":null,"severity":"error","filePath":"src/connector/src/schema/schema_registry/client.rs","lineNumber":132,"sourceCode":"    retry_config: SchemaRegistryRetryConfig,\n}\n\n#[derive(Debug, thiserror::Error)]\n#[error(\"all request confluent registry all timeout, {context}\\n{}\", errs.iter().map(|e| format!(\"\\t{}\", e.as_report())).join(\"\\n\"))]\npub struct ConcurrentRequestError {\n    errs: Vec<itertools::Either<RequestError, tokio::task::JoinError>>,\n    context: String,\n}\n\ntype SrResult<T> = Result<T, ConcurrentRequestError>;\n\n#[derive(thiserror::Error, Debug)]\npub enum SchemaRegistryClientError {\n    #[error(transparent)]\n    InvalidOption(#[from] InvalidOptionError),\n    #[error(\"read ca file error: {0}\")]\n    ReadFile(#[source] std::io::Error),\n    #[error(\"parse ca file error: {0}\")]\n    ParsePem(#[source] reqwest::Error),\n    #[error(\"build schema registry client error: {0}\")]\n    Build(#[source] reqwest::Error),\n}\n\nimpl TryFrom<&ConfluentSchemaRegistryConnection> for Client {\n    type Error = InvalidOptionError;\n\n    fn try_from(value: &ConfluentSchemaRegistryConnection) -> Result<Self, Self::Error> {\n        let urls = handle_sr_list(value.url.as_str())?;\n\n        Client::new(\n            urls,\n            &SchemaRegistryConfig {\n                username: value.username.clone(),\n                password: value.password.clone(),\n                ..Default::default()\n            },","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/connector/src/schema/schema_registry/client.rs#L114-L150","documentation":"SchemaRegistryClientError::ParsePem is returned when the CA certificate file was read but its contents could not be parsed as PEM certificates (reqwest::Error from the certificate builder). It indicates malformed or non-certificate content in the configured CA file.","triggerScenarios":"Building the schema registry Client when add_ca_certificate / pem parsing of the file contents fails — e.g. the file is empty, contains a private key instead of a cert, or has invalid base64/PEM headers.","commonSituations":"Downloading the wrong cert (private key or chain), truncated copy-paste of the PEM, concatenating certs incorrectly, or pointing the CA option at a JKS/PKCS12 keystore.","solutions":["Validate the file: openssl x509 -in ca.pem -noout -text (must parse as a certificate).","Ensure the file starts with -----BEGIN CERTIFICATE----- and re-export the cert in PEM format.","Verify you did not accidentally provide the private key or a binary keystore.","Regenerate/redownload the CA cert from the source (e.g. kubectl get secret ... ca.crt)."],"exampleFix":"// before\nca_cert: \"/certs/keystore.p12\"\n// after\nca_cert: \"/certs/ca.pem\"  # openssl x509 -in /certs/ca.pem -noout","handlingStrategy":"validation","validationCode":"let pem = std::fs::read_to_string(&ca_path)?;\nif !pem.contains(\"-----BEGIN CERTIFICATE-----\") {\n    return Err(format!(\"{} is not a PEM certificate\", ca_path));\n}\n// optional deep validation\n// openssl x509 -in ca.pem -noout","typeGuard":null,"tryCatchPattern":"match build_client(conn) {\n    Ok(c) => c,\n    Err(SchemaRegistryClientError::ParsePem(e)) => {\n        eprintln!(\"invalid PEM in CA file: {}\", e); return Err(e.into());\n    }\n    Err(e) => return Err(e.into()),\n}","preventionTips":["Always export certs in PEM (not JKS/PKCS12 or raw keys).","Validate with `openssl x509 -in ca.pem -noout` before deploying.","Never hand-edit PEM files; copy whole cert blocks including END lines.","Separate CA certs from private keys in secret management."],"tags":["tls","pem","certificate"],"backgroundTag":"schema-validation-failed","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}