{"record":{"id":"b704b26cfeff02f0","repo":"goharbor/harbor","slug":"internal-tls-enabled-but-can-t-get-cert-file-w","errorCode":null,"errorMessage":"internal TLS enabled but can't get cert file %w","messagePattern":"internal TLS enabled but can't get cert file %w","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/common/http/tls.go","lineNumber":54,"sourceCode":"// GetInternalTLSConfig return a tls.Config for internal https communicate\nfunc GetInternalTLSConfig() (*tls.Config, error) {\n\t// generate key pair\n\tcertPath := os.Getenv(internalTLSCertPath)\n\tif _, err := os.Stat(certPath); err != nil {\n\t\treturn nil, fmt.Errorf(\"internal TLS enabled but can't get cert file %w\", err)\n\t}","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/goharbor/harbor/blob/7b2fd08cc568955cca339afeefab27372840d936/src/common/http/tls.go#L36-L72","documentation":"Startup error in GetInternalTLSConfig: internal TLS is enabled but the certificate/key pair could not be loaded from the paths given by the internal TLS cert/key environment variables (%w wraps the os/fs error, e.g. missing file or bad permissions). It fires when the cert file at the configured path cannot be read.","triggerScenarios":"Thrown at src/common/http/tls.go:54 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the internal TLS cert path env var points to an existing cert file","Check file permissions so the Harbor process can read the cert/key","Regenerate or remount the internal certificate if it is missing in the container"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"7b2fd08cc568955cca339afeefab27372840d936","analyzedAt":"2026-08-16T00:00:10.961Z","contentChangedAt":"2026-08-16T00:00:10.961Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}