{"record":{"id":"b561bf9f5470197b","repo":"quickwit-oss/quickwit","slug":"no-ca-certificate-found-in-ca-path","errorCode":null,"errorMessage":"no CA certificate found in `{ca_path}`","messagePattern":"no CA certificate found in `(.+?)`","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"quickwit/quickwit-transport/src/tls.rs","lineNumber":246,"sourceCode":"        spawn_cert_reload_task(resolver.clone(), *tls_config.cert_poll_interval);\n        builder.with_client_cert_resolver(resolver)\n    } else {\n        builder.with_no_client_auth()\n    };\n    client_config.alpn_protocols = vec![b\"h2\".to_vec()];\n    Ok(Arc::new(client_config))\n}\n\n/// Loads the CA certificate(s) at `ca_path` into a [`RootCertStore`].\nfn load_root_cert_store(ca_path: &str) -> anyhow::Result<RootCertStore> {\n    anyhow::ensure!(\n        !ca_path.is_empty(),\n        \"TLS CA certificate path (`tls.ca_path`) is not set; it is required to verify peer \\\n         certificates\"\n    );\n    let ca_certs = load_certs(ca_path)\n        .with_context(|| format!(\"failed to load TLS CA certificate(s) from `{ca_path}`\"))?;\n    anyhow::ensure!(\n        !ca_certs.is_empty(),\n        \"no CA certificate found in `{ca_path}`\"\n    );\n    let mut roots = RootCertStore::empty();\n    for ca_cert in ca_certs {\n        roots.add(ca_cert)?;\n    }\n    Ok(roots)\n}\n\n/// Spawns a background task that reloads `resolver`'s certificate, driven by both a periodic poll\n/// (`cert_poll_interval`) and the process-wide [`CERT_RELOAD_TX`] trigger (e.g. `SIGHUP`).\n///\n/// The task only holds a `Weak` reference, plus a transient strong reference while reloading. Once\n/// the owner drops the config (the sole strong owner) the next `upgrade` fails and the task\n/// returns.\nfn spawn_cert_reload_task(resolver: Arc<ReloadableCertResolver>, cert_poll_interval: Duration) {\n    let weak_resolver = Arc::downgrade(&resolver);","sourceCodeStart":228,"sourceCodeEnd":264,"githubUrl":"https://github.com/quickwit-oss/quickwit/blob/a39730c5cdcd1a4fe798403737ae293999ea21f8/quickwit/quickwit-transport/src/tls.rs#L228-L264","documentation":"After loading certificates from `tls.ca_path`, load_root_cert_store verifies that at least one CA certificate was parsed. If the file exists but contains no parseable PEM certificates, it fails with this ensure! error, since an empty RootCertStore cannot verify peers.","triggerScenarios":"ca_path points to a file with no PEM `-----BEGIN CERTIFICATE-----` blocks (e.g. a private key file, an empty file, or DER/binary format instead of PEM); file contains only intermediate cert chains in an unparseable format.","commonSituations":"Pointing ca_path at the server key file by mistake; using a DER-encoded CA instead of PEM; a mis-mounted Kubernetes secret that produced an empty or wrong file.","solutions":["Verify the file at ca_path contains PEM-formatted certificate(s) starting with -----BEGIN CERTIFICATE-----","Convert DER to PEM if needed (openssl x509 -inform der -in ca.der -out ca.pem)","Check that the file is non-empty and mounted correctly (not the private key)"],"exampleFix":"// before\nca_path: \"/etc/quickwit/tls/server.key\"   // key file, no certs\n// after\nca_path: \"/etc/quickwit/tls/ca.pem\"       // PEM CA bundle","handlingStrategy":"validation","validationCode":"# bash precheck\ngrep -q -- \"-----BEGIN CERTIFICATE-----\" \"$CA_PATH\" || { echo \"$CA_PATH has no PEM certs\"; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Point ca_path at a PEM CA bundle, never a key or DER file","Verify certificate files with `openssl x509 -in ca.pem -noout` before deploying","Check secret mounts produce non-empty, correct-format files"],"tags":["tls","certificate","config","pem"],"backgroundTag":"invalid-config-value","analyzedSha":"a39730c5cdcd1a4fe798403737ae293999ea21f8","analyzedAt":"2026-09-08T13:19:37.784Z","contentChangedAt":"2026-09-08T13:19:37.784Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}